Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.In my installation, a node is unpublished and nodeaccess is set to allow access to this type of node to Anomymous users. I discovered that anonymous users are now able to access unpublished content. Is this how it is supposed to work? This has not been the case with 6.x, or has it?
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | nodeaccess-access_unpublished_node-1444040-2.patch | 1.84 KB | vlad.pavlovic |
Comments
Comment #1
areikiera CreditAttribution: areikiera commentedSame problem. Would really like to be able to restrict access to unpublished nodes for anonymous users, and any users who haven't been granted the permission to publish/unpublish nodes (of selected content types).
I know in http://drupal.org/node/346888, it was noted that this was a core issue in 6, and it looks like it's still a core issue in D7, however they've appeared to add documentation for module developers to address the issue. See http://drupal.org/node/920614 for reference.
I'm not familiar enough with module development to offer a fix. I would be happy to help test or offer whatever help I can to get this fixed.
As the project page says that this module is unsupported, should I just abandon this module and find another option to get around this issue? I really like how this module functions, and think it's a valuable option that I hope will continue to be available and maintained (and wish I had the experience to maintain it; just wanted to voice my opinion that I think it's a great module). Thanks!
Comment #2
vlad.pavlovic CreditAttribution: vlad.pavlovic commentedThank you both, for reporting the issue and the links to the discussions about it.
Attached is a patch that will address the issue.
Nodeaccess will now cede control for unpublished nodes to the default Drupal permissions. So if a node is unpublished, the users will only see it if 1) they are authors AND have 'view own unpublished content' permission or 2) if they have 'bypass node access' permission.
Please note that this only covers the 'View' access.
I will push it to dev shortly.
Comment #3
natukThank you vlad.pavlovic for this patch. It works for me. I have applied it in my installation, rebuilt permissions and cleared cache. Anonymous users can no longer have access to unpublished content.
Comment #4
vlad.pavlovic CreditAttribution: vlad.pavlovic commentedPushed to dev, added to 7.x-1.0 release.