(First off, thanks for the wonderful module -- definitely fills a core workflow gap!)

I've only been using this module recently, so what I think might be a bug may very well be my own misunderstanding.

With a clean Drupal 6 install, with the latest revisioning and module_grant modules, I've
- Edited the 'page' node type and checked 'New revision in draft, pending moderation'
- Configured revisioning to 'Display latest revision' for both viewing and editing

Then I:
- Create a new node, and publish it
- Create a revision, and leave it unpublished
- Logout
- View the created node with an *anonymous* user
- It shows me the latest, unpublished revision

I expected that, as an anonymous user, I would only see the latest published revision.

If, in revisioning.module, I change the following code:

function _revisioning_view($node) {
  if (_revisioning_load_op($node, 'view') == REVISIONING_LOAD_LATEST) {

to:

function _revisioning_view($node) {
  if (_revisioning_load_op($node, 'view', TRUE) == REVISIONING_LOAD_LATEST) {
  ...

... it works as expected.

Is this a bug or is this working as intended?

Comments

rdeboer’s picture

Title: Permissions bug -- anonymous user can see unpublished revisions » "View latest" option: anonymous user can see unpublished revisions
Assigned: Unassigned » rdeboer
Status: Active » Fixed

Well-spotted, thanks Kendall. This was indeed a bug and the fix I've just checked into the repository (CVS HEAD). is very much what you suggested.

kpander’s picture

Great -- thanks for the quick response!

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.