I am working on a Drupal 7 module called Anonymous Publishing. In brief: It lets the anonymous user create posts.

The anonymous user create contents using the standard content creation node_form. When the user press save, Drupal automatically creates and loads the node. However, since the node is unpublished at this point, the user just gets an access denied message. I want to avoid this, and instead show the user the node just created. I've so far only managed to do this with this rather nasty kludge in a hook_node_grants():

$result = db_query("SELECT created FROM {node}
   WHERE nid = :nid", array(':nid' => $nid))->fetchField();
$delta = time() - $result;
if ((0 == $account->uid) && ($delta < 20)) {
  $grants['anonymous_publishing'] = array(1);
return $grants;

What the above code does is this: It checks the age of the node, and if it was created less than 20 seconds ago, it grants the anonymous user the right to view it.

While this works (sort of) it is ugly and it may even expose the content to someone else if there is another anonymous user around that requests the content within the same 20 second window.

Any suggestions for a better solution?

2 Answers 2


You can (relatively) safely store per-user data for anonymous users in $_SESSION. So if you intercept the node page view callback and add some extra code in there for the case in question (falling back to the core function), you should be able to achieve what you are after.

To elaborate: when you save the node in question, save its ID and an expiry timestamp in an array in the session, via a hook_node_insert. In the new callback check if that entry exists and has not expired. If present, fetch the node and display it. Otherwise call the regular node view callback.


In Drupal 7, users are not allowed to view any unpublished content by default, not even content created by themselves. By enabling 'View own unpublished content', you grant users access to their own unpublished content.

The only way to allow users access to all unpublished content in Drupal 7 (without using a contributed module), is to enable the permission 'Bypass content access control'. Use this permission with extreme caution as it has far more consequences than just allowing access to unpublished content. In combination with Organic Groups for example, this permission allows access to private group content regardless of whether the user is a group member.

The module View unpublished allows you to grant access for specific user roles to view unpublished nodes of a specific type. Access control is quite granular in this regard. Additionally, using this module does not require any modifications to your existing URL structure.


  • 1
    I don't think this applies - as I understand it the OP is asking how to grant permission for the anonymous user that specifically created the content, not for the entire anonymous user role
    – Clive
    Apr 4, 2013 at 12:35
  • 1
    Nope, that's something completely different too :)
    – Clive
    Apr 4, 2013 at 12:41
  • Hmmm.. This one 1) does not answer the question, and 2) suggests methods that is adverse to security. "View own unpublished content" or the "View unpublished" module will not work as they will expose the unpublished content to anyone not logged in (and not only the person that created it). And "Bypass access control" should obviously only be given to trusted users and is totally inappropriate in the context of the anonymous user. – Gisle Hannemyr 4 hours ago Apr 5, 2013 at 3:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.