Closed (fixed)
Project:
Views (for Drupal 7)
Version:
6.x-2.8
Component:
node data
Priority:
Critical
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
9 Feb 2010 at 13:29 UTC
Updated:
26 Mar 2011 at 20:41 UTC
Attached a view that shows published and unpublished content of a user. It is meant to help users to find back their content both published and still unpublished content. With another module they have the permission to write content, but leave it still unpublished (draft). The normal user obviously does not have admin rights.
The bug is that the filter Node access: Access" should not list nodes where the logged-in user has no permission.
To reproduce this bug you submit some content as user A and leave it unpublished and then log in as user B and look at the unpublished tab of user A. Because user B should not have access to unpublished nodes of user A, there should not appear anything and the whole tab should not be there.
| Comment | File | Size | Author |
|---|---|---|---|
| my_content_view.txt | 10.45 KB | ñull |
Comments
Comment #1
merlinofchaos commentedDrupal's node access query does not actually checked 'published' status when determining if the user has access to the node. That is a separate check that must be added to the query. You need to add the node: published filter or the node: published or is admin filter.
Comment #3
marktheshark commentedSorry if re-opening this is the wrong action to do, but I'd like to ask a related question without opening a new thread for it.
It seems to me that the "node: published" filter cannot help when a field of an unpublished node is used in the view via a relationship.
e.g. let's say you have a view that lists users, but you also want to display pictures belonging to them by adding the image content type via a relationship, and you want to hide unpublished images from users that are not authorized to see them, (e.g. users without the administer 'nodes permission').
However, you don't want the result set to be different, just the corresponding images to not be displayed, or replaced by the imagefield default image (if set). Therefore the 'pubished' filter cannot be used, or you'll get fewer results.
Is there any way around this, or do I need to theme the row myself and check if the image is unpublished in there?
Comment #4
merlinofchaos commentedIf you don't want the result set different, then I'm afraid you will need to theme the result to make this happen.
Comment #5
marktheshark commentedThank you!
I assume there is no views add on module that might take care of this? (For the record, I do know how to theme it and will do so lacking other options)
This may be per views/drupal design, but I would imagine the need to hide a query output field (and not an entire row) based on publication status is a popular one...