1

I'm needing to set different 'create content' permissions for different user roles. This only appears to work when a particular role has not been given the "administer node" permission. However, without this permission the role does not have permission to control whether or not the node is published (which I require) or to view the content management table (Home › Administer › Content management).

For example, I want a user role to be able to create new news items and to be able to publish/unpublish them, but not create new pages (but be able to edit existing pages).

Does anyone know a way around this? Or which permissions should be set?

3 Answers 3

5

Administer Nodes permission gives more access than necessary, and some modules use it as a crutch permission since it exists.

You might want to switch off this permission and implement Override Node Options module which will let users publish unpublish content. These can work in conjunction with the create/edit/delete permissions at the content type level.

5
  • Thanks for the response, but do you know if this will allow those users to access the content management page? I'm being told that is essential. Jul 26, 2010 at 19:24
  • 2
    Oh, no. Without Administer Nodes, you can't get to Edit. You can, however, recreate this page with Views and put it in the administrative Content (with exposed filters too). This is what I normally do so clients don't have too much access.
    – Kevin
    Jul 26, 2010 at 20:10
  • Also, you will need to make sure input filters are set correctly. Nodes that are Full HTML for example, roles will need access to that once they lose Administer Nodes.
    – Kevin
    Jul 27, 2010 at 0:10
  • 1
    Thanks for the great feedback. Personally I find this standard Drupal behaviour very frustrating as you'd think that if a user can edit some content then they should be able to view a list of that content! Jul 27, 2010 at 9:17
  • 1
    Since discovered that the Content Management Filter module works without the administer nodes permission which gets round the content table issue. Jul 27, 2010 at 10:16
0

See the patch provided here http://drupal.org/node/214190 It looks like Drupal 7 may allow for this separation of permissions between publishing and full-blown administering, but for now you'll have to use the patch.

0

I didn't want to install another module so I put this code in hook_init() in one of our custom modules. Enforces the node/add page, by giving an access denied if the users do not have the "create * content" permission.

  $arg = arg();
  // Quick hack to enforce node creation permissions.
  if (   $arg[0] == 'node'
      && !empty($arg[1])
      && $arg[1] == 'add'
      && !empty($arg[2])
        ) {
    $arg[2] = str_replace('-', '_', $arg[2]);
    if (!user_access('create ' . $arg[2] . ' content')) {
      drupal_access_denied();
    }
  }

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.