Contrib.social

Publish nodes permission

Open on Drupal.org →
Created on 25 January 2008, about 17 years ago
Updated 19 March 2025, 16 days ago

In our instance of Drupal, we allow authenticated users to publish to the front page. The only way to give users this privilege is to give them access to the "administer nodes" permission:

  $form['options'] = array(
    '#type' => 'fieldset',
    '#access' => user_access('administer nodes'),
    '#title' => t('Publishing options'),
    '#collapsible' => TRUE,
    '#collapsed' => TRUE,
    '#weight' => 25,
  );
...

However, because of the way node_access is implemented, having the "administer nodes" privilege gives you full access to all node operations, including editing other users nodes:

function node_access($op, $node, $account = NULL) {
...
  if (user_access('administer nodes', $account)) {
    return TRUE;
  }

The patch included creates a new permission, "publish nodes," which allows an admin to select which groups should be able to publish nodes, thus separating the privilege from the ability to administer nodes.

✨ Feature request
Status

Postponed: needs info

Version

11.0 🔥

Component

node system

Created by

🇺🇸United States jgoldberg

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • Comment 16 days ago →
    🇦🇺Australia acbramley

    Is this still something that core needs to support? We have 2 well maintained modules mentioned here https://www.drupal.org/project/override_node_options → and https://www.drupal.org/project/publishcontent →

    Core also provides content moderation for much finer control over publishing workflows and permissions.

  • Comment 16 days ago →
    🇺🇸United States dww

    IMHO, yes, this is something core should do. Reading the comments, we've got "yes this is a good idea" from all sorts of folks who are either past or current release managers, product managers, etc. It's fairly absurd that we have granular permissions for delete, but not publish/unpublish. Yes, content moderation provides more advanced publishing workflows. But for something so fundamental to a content management system as publish status, I think core needs to solve this.

  • Comment 16 days ago →
    🇺🇸United States dww

    Just marked 🐛 Users can edit/delete content but not unpublish it Active duplicate with this, which had 35 followers.
    I imagine there are other duplicates lurking in the issue queue for this.
    This is a very common need. Further evidence core should provide this out of the box.

    Thanks!
    -Derek

  • Comment 16 days ago →
    🇦🇺Australia acbramley

    @dww no worries! Lots of these very old issues have those types of comments that have since gone stale so I'm asking the question as of 2025 with all our new tools :)

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024