Module Grants

RdeBoer - March 20, 2009 - 02:03

Module Grants makes modules that deal with content access permissions operate better on unpublished (as well as published) content. It also makes sure that access grants behave in an orderly fashion when such modules are used together.

Access grants are tested for unpublished content just as they are for published content
Allows modules that feature fine-grained access control (e.g. Workflow, TAC-Lite) to work together
While Module Grants' raison d'etre is to act as a catalyst amongst other modules when dealing with unpublished content and/or fine-grained access control, it does come with a handy feature of its own; a new menu option Accessible content shows a summary of all the content the logged-in user has access to (i.e. view, edit) after access controls have been applied by the content access modules installed on your site. So if you have Workflow installed then what's editable to you and what's only viewable to you will depend on the workflow state the content is in. With the TAC-Lite module enabled it will depend on the vocabulary term(s) used in the content.

This module works around a couple of quirks in the core access permission system that tend to get in the way, for instance when you set up workflows, in particular when dealing with categorised content.

By ensuring that access grants are tested for unpublished content just as they are for published content this module allows you to implement approval workflows that deal effectively with content moving from author to moderator BEFORE it is published (i.e visible to the public). And that's probably where it's needed most: once content is visible for all to see, it's a bit late to start an approval process!

Module Grants works particularly well with Revisioning in creating content approval and publication workflows. See the Revisioning project page for some step-by-step tutorials.

When publication workflows and category-based content are used together (e.g. after installing Workflow and TAC-Lite) this module makes sure that their combination exhibits the expected behaviour: access is granted to content only when it is in the right state AND (rather than OR) of the right category.
For example, when taxonomy access control is set up so that an Arts moderator/publisher can't view a Sports article, because Arts moderators don't have access to the “sports” term, then it would be wrong if that Arts moderator suddenly does obtain access to Sports, when someone put content in the “review” state, and by the workflow access grants moderators are allowed to view content in "review". Yet, this will be the behaviour you'll find if you don't have this module installed.

Installation instructions can be found on the Module Grants documentation page.

Latest features

Available in 6.x-2.x-dev (10 Nov 09 or later)
o Fixed #567968: 'Accessible content' link disappears, if "access 'I last modified' tab" AND/OR "access 'Published' tab" permissions are disabled.
To implement the fix Module Grants now requires Smart tabs.
If you don't like the memory function that Smart tabs brings to your pages, but would still like your tabs on Module Grants' Accessible content page to work properly without any permission issues, then simply go to Aminister >> Site configuration >> Smart tabs and blank out the Pages to include text box on the page.
If you want the Smart tabs memory function for the Accessible content page only, then enter in the Pages to include text box the following 2 lines:

accessible-content
accessible-content/*

If you're happy to have the memory function on all your pages enter * in the text box.
o Updated translations: German [thanks: tadesse] and French [thanks: chmoindron].
o Fixed #572804: An illegal choice... when trying to set any module_grants permissions and #566290: Permissions are not allowed to have special chars
o #564318: Special case with Domain Access Fix for usage with Domain Access module [thanks dkruglyak].
o Fix display of vocabulary terms of Accessible content page
o Updated README.txt #550988: access content summary Where is it? I don't have that permission
o #540904: Missing call to t() in module_grants.module [thanks, dboulet].
o Fix regarding "view revisions of own content" permission, see #513078: Flexible revision permissions., comments #44, #50.

Available in 6.x-2.6 (23 July 09)
Bug fix: #526158: Revisions tab doesn't show when content only has one revision
Available in 6.x-2.5
o Feature: the presence/absence of each of the content filtering tabs on the Accessible content page is now configurable per role. See User management>>Permissions. Please note that each role that is to see the Accessible content page must have at least the "access 'I last modified' tab" and "access 'Published' tab" permissions checked. If not, the Accessible content menu item may not appear or they'll get the message "You are not authorized to access this page."
o Bug fix: #497920: Wrong datatype for second argument module_grants.module on line 366
o Feature: OR / AND toggle, see #470964: Should grants be OR'ed or AND'ed?
o Feature: More tabs to filter content accessible to the logged-in user:
Top row: "I created" | "I last modified" | "I can edit" | "I can view"
Second row: "Published" | "Unpublished | "All"
o Feature: #433412: Sortable columns for 'My content' page

Available in 6.x-2.4 and later:
o #453436: Add configurable setting that enforces explicit AND between multiple node access modules [thanks: mcarbone]
A new admin setting Administer >> Site configuration >> Module grants was introduced to make the use of multiple content access control modules together even more natural, especially when on the same site some content types are involved in workflow and/or taxonomies while other content types are not.
This checkbox has an effect only when two or more content access modules are enabled and one of the modules makes no statement about a node being accessed. If this box is checked ("lenient", the default), then a content access module saying nothing (via the node_access table) about the node in question will be deemed to be ok with the user having access to it. If not checked ("strict"), then a module saying nothing will be taken as a "deny access" (pre 6.x-2.4 behaviour).

Important: If you upgrade Module Grants to a later version and you also use Revisioning make sure to also upgrade that module to the latest version. And don't forget to visit Site building>>Modules so that the changes are activated.