Problem/Motivation
The Content overview Views view filters out unpublished nodes that the given user otherwise would have access based on node access.
This issue were already reported in Drupal 7 (#1264482: Cause and work around of user not seeing own unpublished content in views) and the content moderation issue (#2971902: Unpublished content is not visible in views to users with the 'view own unpublished content' permission when used in combination with node grants) is also (partially ?) about this problem.
The root cause of the problem is \Drupal\node\Plugin\views\filter\Status that adds additional filter criteria to the query - this is the reason why ppl are suggesting disabling SQL rewriting in the content moderation thread - that filters out the result based on user permission. (See \node_views_query_substitutions())
The original code logic originates from Drupal, but I could not figure out from git history why this borned... https://git.drupalcode.org/project/views/-/commits/7.x-3.x/modules/node/...
PS.: \Drupal\node\Plugin\views\filter\Status is not the only one in Drupal core that implements the same trick, there is \Drupal\media\Plugin\views\filter\Status also.
Steps to reproduce
(See failing test in MR8156)
- Create a "content viewer" user with only the following permission: access content overview. Node admin permissions MUST NOT BE granted, see
\node_views_query_substitutions(). - Create unpublished contents with another user.
- Enabled a node access solution that would grant access to unpublished nodes to "content viewer" user.
- Check the node view page of an unpublished node with the "content viewer" user. Expected: HTTP 200
- Check the admin/content page with the "content viewer" user. Expected: unpublished nodes by other users are visible. Actual: they are missing.
.
.
.
.
Proposed resolution
Disable query altering when there is any node access module active on a site.
Remaining tasks
Title update
Review of new text
User interface changes
Before
After
API changes
None.
Data model changes
None.
Release notes snippet
Unpublished nodes are no longer hidden on Content overview page when a node access module is enabled
The Content overview page now respects the access granted in a node access module. If your site is using such a module then site administrators may see different results on the Content over page. Sites should check the behavior of the views that display nodes.