Tac_Lite seems to ignore Node's published/unpublished status

Experiencing the same issue. However we're using Workbench Moderation instead of Revisioning.

Seems tac_lite overrides whatever access hook revision/workbench use to implement access to drafts/unpublished revisions.

In my mind, not a bug. tac_lite shouldn't care whether node is published or not.

If you're using views.module, add a filter to hide unpublished nodes. If you're using code or something else, I'm sure it also has a way to filter based on node status.

I think it makes sense to add a checkbox to the scheme settings form. Would say something like "This scheme applies to unpublished nodes". Then in tac_lite_node_access_records(), add a check of $node->status.

Anyone care to submit a patch like that?

This seems to be a problem in the _tac_lite_get_terms function called by tac_lite_node_access_records to get a list of the relavant terms for the node. The core taxonomy_index used here by tac_lite only keeps data for published nodes.
The way I fixed it for our case was to install taxonomy_entity_index and use the supplied taxonomy_entity_index table instead.

That sounds like another problem entirely. It's news to me that taxonomy module does not keep track of taxonomy for unpublished nodes.

I'm confused because #6 implies tac_lite would not let users view unpublished nodes (because they'd have no terms), while the original report is that tac_lite does allow users to see unpublished nodes. When I make some time I'll have to experiment and figure out what's really going on.

Sounds like the D6 to D7 push to make everything a field had a lot of side effects for taxonomy and this module is still catching up to them.

I found that _tac_lite_get_terms did not return any tids for any unpublished node but did for the same node if published.

I think the original report had given some roles permission to view unpublished nodes. This was also the way we had our site set up. In that case everyone of that role had access to all the unpublished nodes. Inversely, the roles without permission to view unpublished nodes would not have access even though their taxonomy permissions allowed it.

I don't think that's what the original poster reported. He wrote "Disabling tac_lite renders the unpublished page inaccessible."

If a user has permission to view unpublished nodes, they'll see those nodes regardless of what tac_lite does.

Your patch seems reasonable. But an even better patch would make it work without needing taxonomy_entity_index. I wonder what the reasoning is to not have terms associated with unpublished nodes. Seems like a stupid change.

I think hook_node_access will do the trick for you.
https://api.drupal.org/api/drupal/modules%21node%21node.api.php/function...

In D6 only the module that defined a node type could do it, but in d7 and d8 that hook can implement your logic. It's still reasonable to add a checkbox to a tac_lite scheme so that the scheme does not apply to unpublished nodes.

Hi. First, I don't think there should be an option for whether tac_lite should allow unpublished nodes to be shown. Unpublished is just that - unpublished, and no module should override it unless that's explicitly what's wanted. Note also that hook_node_access_records says, "Implementations must make sure not to grant access to unpublished nodes if they don't want to change the standard access control behavior."

The right solution is just to respect the node status in granting permissions. The attached one-line patch does that. (After the patch is applied, the node permissions will have to be rebuilt once at admin/reports/status/rebuild; after that they'll be maintained correctly.)

One thing I'm unsure of though, is whether it's best to suppress granting just the view permission, or also the update and delete permissions, for unpublished nodes. This patch suppresses granting all three, but it might be better to suppress granting just the view permission. Note that not granting the update or delete permission isn't the same as denying those permissions; they can still be granted elsewhere, but tac_lite won't grant them with this patch.

Dave, I see what you were getting at now. Admins should determine which of the permissions to apply to unpublished content, so we should provide a checkbox for it for each tac_lite scheme.

I see how this would work and I'll work on creating a patch for it. Meanwhile, for admins who just want to be sure right now that their unpublished content isn't being published, #12 provides a quick fix.

Well, that turned out to be easier than I thought. It's because of tac_lite's simple design.

This patch creates a new checkbox, "Apply to unpublished content", in each TAC Lite scheme. Permission grants in the scheme are only applied to unpublished nodes if the box is checked. By default the box is unchecked, so unpublished nodes won't be made visible.

When the patch is applied, the box will start off unchecked in all existing schemes, but as above admins will need to rebuild their node access permissions (admin/reports/status/rebuild) once in order to stop unpublished nodes from being shown.

I've tested the patch and it works for me. Patch is against current HEAD.

Hi. The patch in #14 was against the current development release. Not sure which version you're using, but here's the same patch against the 7.x-1.0-rc2 release.

I like the direction of this patch. But as I see it, and as this thread indicates, there are two problems.

The latest patch address the problem of "if tac_lite grants access to unpublished nodes, let's make that optional." And as far as I can tell it does that well.

However it does not address the problem of "tac_lite does not grant access to unpublished nodes." That is, tac_lite still uses taxonomy_index table which is not populated for unpublished content.

Andrew I'm curious are you using the earlier patch and taxonomy_entity_index? If not, how are you even testing this?

Here is an improved patch I believe does the job. Please test and let me know.

Sorry it took me a while to get back to this.

Dave, I didn't apply the tac-lite-use-entity-index patch in my earlier testing. I don't know why my patch was able to fix the bug anyway on our site. We use the revisioning module, so maybe that's a factor.

Anyway, I can confirm that the patch in #19 also fixes the bug, so from my point of view it's ready to go.

Ok. Thanks.

Pushed patch. Will tag a release after I review other issues in the queue.

Hi Dave Cohen,

Updated to dev version. Works Great.

========= Ignore below ==========

I have tried applying your patch at #19.

While rebuilding permission it is giving

PDOException: SQLSTATE[HY000]: General error: 1366 Incorrect integer value: '' for column 'gid' at row 2: INSERT INTO {node_access} (nid, realm, gid, grant_view, grant_update, grant_delete) VALUES (:db_insert_placeholder_0, :db_insert_placeholder_1, :db_insert_placeholder_2, :db_insert_placeholder_3, :db_insert_placeholder_4, :db_insert_placeholder_5), (:db_insert_placeholder_6, :db_insert_placeholder_7, :db_insert_placeholder_8, :db_insert_placeholder_9, :db_insert_placeholder_10, :db_insert_placeholder_11), (:db_insert_placeholder_12, :db_insert_placeholder_13, :db_insert_placeholder_14, :db_insert_placeholder_15, :db_insert_placeholder_16, :db_insert_placeholder_17); Array ( [:db_insert_placeholder_0] => 45 [:db_insert_placeholder_1] => all [:db_insert_placeholder_2] => 0 [:db_insert_placeholder_3] => 1 [:db_insert_placeholder_4] => 0 [:db_insert_placeholder_5] => 0 [:db_insert_placeholder_6] => 45 [:db_insert_placeholder_7] => tac_lite [:db_insert_placeholder_8] => [:db_insert_placeholder_9] => 1 [:db_insert_placeholder_10] => 0 [:db_insert_placeholder_11] => 0 [:db_insert_placeholder_12] => 45 [:db_insert_placeholder_13] => tac_lite_scheme_2 [:db_insert_placeholder_14] => [:db_insert_placeholder_15] => 0 [:db_insert_placeholder_16] => 1 [:db_insert_placeholder_17] => 0 ) in node_access_write_grants() (line 3546 in node.module)