Add dedicated permission for toggling content published status

Created on 12 September 2016, over 8 years ago
Updated 17 April 2024, 8 months ago

Problem/Motivation

Users without the permission to edit and delete content of a specific content type (such as article) cannot unpublish it, unless they also have the permission "administer content" which then applies to all content types.

With the "administer content" permission, users only see a "Save" button on the content form, but they see "Publish" and "Unpublish" as available actions in the bulk operations on the content overview page. However, if they then try to unpublish seleceted content, they get a message that they don't have access.

With "administer content" permissions they can unpublish content, but then they have no access to see unpublished content (such as /node/123), but if they know the node ID, they can still it's edit form (/node/123/edit).

In order to let users see unpublished content, they need to have "Bypass content access control" which also applies to all content types - and of course allows them to delete anything.

So, basically it's easier to give users the permission to delete content then to unpublish it - or it's a bug and unpublishing content is part of editing content, but it's broken.

However, a typical set up is to give a larger group of users the right to just unpublish content, and only fewer users with a different role the permission to actually delete content.

Proposed resolution

Allow the publishing and unpublishing of content per content type, or fix (un)publishing as part of "edit content" per content type.

Remaining tasks

User interface changes

API changes

Data model changes

✨ Feature request
Status

Active

Version

11.0 πŸ”₯

Component
Node systemΒ  β†’

Last updated 4 days ago

No maintainer
Created by

πŸ‡³πŸ‡±Netherlands ifrik

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • πŸ‡ΊπŸ‡ΈUnited States thejimbirch Cape Cod, Massachusetts

    Thanks to @sidgrafix for pointing out the https://www.drupal.org/project/override_node_options β†’ module adds additional permissions for a role to unpublish content without giving them permission to delete it.

  • πŸ‡©πŸ‡ͺGermany Anybody Porta Westfalica

    Just ran into the same situation and couldn't believe this issue indeed still exists. So setting the priority to major and hope for active discussions.

    Content editors are not able to unpublish content!

    From #17:

    A user with permission to view their own unpublished content and edit own content absolutely should be able to "UNPUBLISH" their own content.

    I totally agree with this. Alternatively, we need a separate permission, if there's no good logical combination. The current situation is really unexpected for site builders. You should never need content moderation for such a simple thing.

    So the question is: Which permission should this be tied to or should it be a separate permission?

  • πŸ‡ΊπŸ‡ΈUnited States Rick Hood

    I ran into this issue. I see another module that seems to help
    https://www.drupal.org/project/publishcontent β†’
    Works with Drupal: ^8.8 || ^9 || ^10
    15,554 sites report using this module

  • leymannx Berlin

    Making this a feature request instead of a bug. I think we can make it move forward faster that way. To me it sounds more like this was just not yet considered and implemented in core. So, let's implement it now.

  • leymannx Berlin

    I also think that a dedicated toggle publish status permission is the way to go here, as with binding it to the delete permission we might run into the following paradoxon:

    While "a user who can delete content should also be able to unpublish it" might sound right the following statement does not "a user who can delete content should also be able to publish it".

  • leymannx Berlin

    First thing to tackle: Let's find the place in code where the publishing option becomes available/unavailable in the form :)

Production build 0.71.5 2024