Direct link to view unpublished node causes redirect loop

Question

When I unpublish a node and have another user without permissions to view unpublished content trying to access that node (through an external link for example) it will generate a redirect loop. It just does a bunch of 302's to the same page, until the browser stops it.

I would expect an "access denied" page. What could cause the redirects to the same page?

Disabling "global redirect" module didn't have an effect. I don't have any rules or module code relating to it either.

Update:

Anonymous visitors get redirected to the /user/login page. Authenticated users don't have "view unpublished nodes" permission.

I guess I can change my 403 page to something other than /user/login to fix the redirect loop.

Question:

How would I create a regular page and show the login form if they are not logged in already, otherwise show a "page has been deleted" error?

Answer 1

I guess I can change my 403 page to something other than /user/login to fix the redirect loop.

Yes, that seems like it would cause the redirect problem.

But it sounds like you want to have a login page when the user gets an access denied message, and there is a module to do exactly that: r4032login

LoginToboggan may provide a similar feature, but I find that r4032login does a very simple thing and it does it well. On the other hand, I've run into several bugs with LoginToboggan.

Answer 2

Apologies if I haven't understood this properly, but I think the LoginToboggan module can help with this. One of its features is to:

Provide a login form on Access Denied pages for non-logged-in (anonymous) users.

That would mean anonymous users accessing your unpublished nodes would be presented with a login form, and authenticated users accessing it would get a 403 error.

Then you can take off any 403 redirect you have to user/login as the login will display by default on those pages.

Answer 3

Assuming you want to keep your 403 set to user/login then you could create a new rule as follows for auth users:

1. Event: Content is viewed
2. Condition: Content is (NOT) published.
3. Condition AND User has role: Authenticated.
4. Action: Redirect to
5. Action: AND Show a message "This content has been unpublished."

That said you could also remove the 403 set so that authenticated users get Drupal's default access denied message and then redirect anonymous users to the login page using either Rules or LoginToboggan.