Revisioning + Workflow D7: anonymous users can't see current/published content

Hi,
That tutorial is actually for Revisioning and Workflow in D6. Workflow D7 came out fairly recently and I have not tried that combo myself yet, but am glad you're taking it for a spin!
Can I confirm that you are using Revisioining 7.x-1.3 and Workflow 7.x-1.0 ? Or are you using dev versions?
Rik

Revisioning 7.x-1.x-dev and Workflow have changed considerably since this issue was raised.
Please re-open if the issue still exists with the latest versions of these modules.
Rik

I seem to be having a similar issue. Not sure if this is and issue with Revisioning or Workflow, but since I found this issue I'll post it here. When I first create a node in the draft state, it is immediately viewable by anonymous users. I initially experienced this problem on a site I've upgraded from D6 to D7. I set up a clean site to do further testing:

drupal 7.22
revisioning 7.x-1.4+36-dev
workflow, workflow_access and workflow_admin_ui 7.x-1.1+6-dev

I set up revisioning and workflow according to http://drupal.org/node/408968 and http://drupal.org/node/408052. I didn't want to complicate things, so I skipped views and rules. I simply set the revisioning options on Basic page, set up the roles with appropriate permissions and configured workflow with 3 states and appropriate access, transitions, etc. If you are unable to replicate my problem, I will elaborate on the exact settings that I ended up with.

If you then create a basic page (I tested as and Author role as well as User 1) in the draft state, the page is unpublished and the revision is pending. If you then log out, you can view the page as an anonymous user.

I'll give it a shot...

I have reproduced the problem with the setup mentioned in #6 of this thread, which includes Revisioning, Workflow and Workflow Access.
I have also reproduced the problem with just Workflow and Workflow Access (no Revisioning).

The problem really is this: Workflow Access implements hook_node_grants(), but it does NOT implement hook_node_access().

The Workflow Access implementation of hook_node_grants() does not consider the published status of the node. It looks at the workflow state access rights only... and that is probably the correct thing to do. However it also does not implement hook_node_access(), which is where it could consider paying some attention to the published flag when the accessing user is the anonymous user.

One way to fix this would be for Workflow Access to implement hook_node_access(). The function takes precedence over hook_node_grants() and could deny access to anonymous users trying to view content that isn't published yet.

For now, though I've handled this in Revisioning's implementation of hook_node_access() as follows:

  // Deny access to unpublished, moderated content by anonymous users.
  if (empty($node->status) && !empty($node->revision_moderation) && empty($account->uid)) {
    return NODE_ACCESS_DENY;
  }

That should fix the immediate problem. Let's run with this for while in 7.x-1.x-dev and see how people like it.

To be perfectly clear: when used with Revisioning give both anonymous and authenticated users View access to ALL 3 workflow states: in draft, in review and live.

For further detials see the comments in the code above function node_access() in the node.module

Check versions dated 11 Apr 2013 or later.

@rdeboer this is great. I tested your fix on both my clean test site and my D6 to D7 upgraded site and everything works as expected. Node status is now considered and nodes don't appear for anonymous users until they are transitioned to the live state. They are also appropriately hidden when you unpublish a node with revisioning's unpublish link (this was not working previously). Thanks again for all your work on this module!

Great then we're all good with the latest dev.

This issue is still happening. And I think It's Workflow issue.
Also, by following comment #1 Adding anonymous to "roles that can see the content in this state". I think this is not a clear way to fix the issue.

What I did is installing a contrib module called "nodeaccess". It manages the node access as the same way of Workflow module by implementing hook_node_grants() and it manages that very well. Now it respects the node status published/unpublished.

Since Workflow is a major module, that's why it uses the hook_node_grants() to make sure to override any other implementation of hook_node_access(). So, I think they may consider to use hook_node_access() with hook_module_implements_alter() and make sure to override other implementations of hook_node_access() without writing in database like what hook_node_grants() did.

I suggest making this issue as - Closed (won't fix) - with a note that tells the Workflow module should respect the node status.

Best of luck!