0

I have a content type called "article". It needs to go through some workflow states when people try to submit a new article: submitted -> review 1 -> review 2 -> published.

During each workflow state, only certain roles should be able to see it, modify it, and comment on it. This needs to be done independently by its current workflow state. The workflow module appears to have access control based on states, but then the access control part does not work so essentially everyone can see the content no matter what state it is in. Not sure if this is a major security bug, permission being overridden by another module, or me doing something wrong.

Any other suggestions for modules that can do workflow? I heard Workbench is another good one. Can it keep track of comments and separate out comments based on workflow states?

|improve this question
  • 1
    Workbench + Workbench Access + Workbench Moderation work very well for that sort of thing, unfortunately it's node support only, no comments. You might well be able to hook into the module to extend it though – Clive♦ Feb 1 '12 at 21:59
  • Thanks for the suggestion. I wish it could do comments, as well, since it makes sense that group1 reviewing may not want group2 to see their comments. I can get around this by building custom comment fields and using permissions. The main point is content access and control based on workflow! If Workbench can do it, then that would be great! I will try it and report back later. – user785179 Feb 1 '12 at 22:02
  • I just tried the Workbench combination for the first time today and I'm very impressed, I got fed up with hacking the Workflow module to do what it's supposed to! – Clive♦ Feb 1 '12 at 22:04
0

Update and solution: Turns out that I was not using the Workflow module correctly and Drupal's permissions correctly. I was assuming that the Workflow module could remove permissions. Instead I had to start with the least privileges in Drupal and then let the Workflow module allow/deny access to the content type.

For example, if Drupal permissions allow a visitor to see unpublished content, then the Workflow module's content access control will not block the person from seeing unpublished content.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.