I have a drupal website allowing anonymous users to post information, specifically a registration form.
This information is not to be public and so, once posted, the anonymous user cannot otherwise see or edit that post.

There are system users that have access to view these posts.

I have setup content access to only allow these system users to view all posts of this type.

The problem:
When an anonymous user posts in this way, the post gets created and that user can no longer access that post. (these posts are set to publish on create)
However, the system users get permission denied.
I have to manually click "rebuild permissions" to fix this problem, until the next post is made.
All new posts suffer from this problem.

I decided to use rules/triggers to try and work around this problem.
I enabled node-specific content permissions and had rules/triggers explicitly set the appropriate permissions on each post after is was created.
This did not solve the problem.
Also note that I tried using the "reset content permissions", but I get a blank whitepage (a white "bluescreen" if you know what I mean) after making a post.

I also discovered that I can make the post work properly without clicking the "rebuild permissions" button.
This is done by going to the specific post in question, selecting the "Access Control" tab, and clicking the submit button.
Keep in mind that I did not change any of the settings nor did I click the reset to defaults button.
Simply clicking "submit" causes it to suddenly realize that the permissions should be followed.

Comments

thekevinday’s picture

Title: Anonymous posts permission issue » "after saving new content" rules redirection happens before content access sets the ACL for individual content

It seems to be unrelated to anonymous posts.

After some testing, the problem happens when the Rules module is used with a page redirection.

I was using the "After saving new content" rule.
Does this mean content access is setting it's ACL for the content type after saving new content as well?
(As opposed to: during saving new content)

When the redirection happens, the content is saved but the content's ACL does not get setup.
According to the devel module all of the content access database data for that specific content is missing.

For now I can tell rules to explicitly save the content (again) inside the "after saving new content" rule before calling the redirection and the content access ACL data gets properly populated.

fago’s picture

Category: bug » support
Status: Active » Fixed

Make sure to don't check the "force immediate redirection checkbox" in rules' page redirect action - as it's default. Then everything's fine.

thekevinday’s picture

Per default drupal doesn't redirect to the given path, if a destination parameter is set. Instead it redirects to the given destination parameter. Most times, the destination parameter is set by appending it to the URL, e.g. http://example.com/user/login?destination=node/2

Is there another way to prevent destination from being used without this checked?

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.