Hey Rik,

just got all new versions of revisioning and module_grants this morning and I am still testing. One major flaw for one of my clients using this module is the visible 'Revisions' tab even for anonymous users.

Within the Drupal system there is a moderated content type called 'Job' (for job offers i.e.). Now, my client created a new content of this type and published it. So there is only one revision (published).
Since job offers may change and for other reasons my client doesn't want any visitors to view the revision list and therefore disallowed anonymous and authenticated users to 'view revisions' (as supplied by node module).
Neither do anonymous or authenticated users have any permissions created by revisioning module.

However, while visiting the page as an anonymous user I still can see two tabs (local tasks): 'View current' and 'Revisions'. I am even allowed to view the revisions list (containing only one revision). When trying to click on this revision I get the 'access denied' message. This was not visible with the 2.x-dev versions.

Am I missing some options or configuration here?
For now I could recreate the behaviour of old versions by changing line 116 in module_grants.module from:

if (get_number_of_revisions($node->nid) <= 1 && !is_moderated($node->type)) {

to

if ((get_number_of_revisions($node->nid) <= 1 && !is_moderated($node->type)) || !user_access('view revisions')) {

This removes both local task tabs for anonymous users while users with proper permissions still are able to view revision lists. But as I asked, maybe I am missing something else here?

Best,
Paul

Btw: Happy New Year! ;)

Comments

rdeboer’s picture

Assigned: Unassigned » rdeboer
Category: support » bug
Status: Active » Fixed

Happy New Year Paul,
And you're absolutely right... oversight in my testing....
Fix implemented very much along the lines of what you suggested.
Released today as Module Grants 6.x.3.3.
Rik

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.