The Node Access documentation explains that there are three things that affect node permissions, used in this order of preference until an answer is received: an overriding bypass node access permission; hook_node_access (used on single nodes and not in listings); hook_node_grants (which compares against the node_access table).

What I can't see is how (un)published content is handled. The only default implementation of hook_node_access is node_node_access which you can see completely ignores the 'view' mode, answering only for create/delete/edit modes.

The hook_node_grants docs say explicitly that (un)published content is "not handled by the system".

But there are the checkboxes in the user permissions table for view published content and view own unpublished content etc. Where are these implemented?


2 Answers 2


It is handled by node_access:

  • it checks for the "view published content" - without this permission every operation is denied, published or not.

  • it checks the view own unpublished content permission.

  • it checks if hook_node_access gives either deny/allow. If not...

  • If no module implements hook_node_grants then there's a default allow for published nodes (and therefore a deny if not).

  • If modules do implement hook_node_grants then the node_access table is consulted. I found that published content receives a "default grant" in the node_access table thanks to node_access_acquire_grants, meaning anyone can view it. Unpublished content has no default grant so is therefore denied.


basically the unpublished content is visible only to those roles that have "Administer content" permission.

you can use this module but I had some problems with it and decided to build my own, lighter module.

  • Where is that checked? Do you mean that the view own unpublished content is not used anywhere? Commented Nov 6, 2012 at 12:48
  • It's not true: Unpublished nodes are also visible to their authors, when they have the "view own unpublished content" permission.
    – apaderno
    Commented Nov 6, 2012 at 14:20
  • yep, @kiamlaluno you're right, sorry, my question was rhetorical. Pls. see my full answer above. Commented Nov 6, 2012 at 14:25
  • @artfulrobot I was saying that to Marius Illie. His answer is not correct for Drupal 7.
    – apaderno
    Commented Nov 6, 2012 at 14:36
  • This is not correct. The permission you meant to say is "Bypass content access control". Then there's a second permission "View own unpublished content" as well.
    – Brian
    Commented Apr 2, 2014 at 19:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.