[drupal-devel] Unpublished nodes still viewable?

[K B]

I did some more testing and here is what I found:

1. An unpublished node is not viewable to any one but those who have
"administer nodes" permission. This means that anonymous visitors and
registered users do not see unpublished nodes.

2. If the default 404 and default 403 settings in /admin/settings are
set to an unpublished node that node is still visible indirectly (i.e.
when a visitor goes to a URL that causes a 404 or 403).

This behavior is new in 4.6RC since Drupal 4.5 did not behave the same way.

On Sun, 20 Mar 2005 12:36:49 -0500, K B <kbahey at gmail.com> wrote:
> The persons who reported this say that they are logged out (i.e.
> anonymous). I don't think they gave anonymous the right to administer
> nodes.
> 
> 
> On Sun, 20 Mar 2005 11:33:06 -0600, Jim Riggs
> <drupal-lists at jimandlissa.com> wrote:
> > On Mar 20, 2005, at 11:24, K B wrote:
> >
> > > Hi.
> > >
> > > If you read this thread http://drupal.org/node/19131 you will see that
> > > there is a different behavior of unpublished nodes from 4.5.x to 4.6.
> > >
> > > Basically, what they have seen is that the unpublished node does not
> > > appear in node lists, but typing its URL directly makes it viewable.
> > >
> > > Is this a by design behavior or a side effect or a bug?
> > >
> > > If it is a bug, should an issue be sumbitted for this?
> >
> > I am not able to reproduce this.  Are you logged in as a user with
> > the 'administer nodes' permission?  If so, you will be able to view
> > the unpublished content.
> >
> >
>