View Unpublished
Allows specific user roles to view unpublished nodes, with granular per-content-type access control.
view_unpublished
Install
composer require 'drupal/view_unpublished:8.x-1.3'
composer require 'drupal/view_unpublished:8.x-1.0'
Overview
The View Unpublished module extends Drupal's content access system to provide fine-grained control over which user roles can view unpublished content. By default, Drupal only allows users with the "view own unpublished content" permission to see their own unpublished nodes, and administrators can see all content.
This module adds new permissions that enable specific roles to view any unpublished content globally or on a per-content-type basis. For example, you can allow editors to preview unpublished articles while restricting their access to unpublished basic pages.
The module seamlessly integrates with Drupal's node access system using the grant/realm mechanism, ensuring proper access control without requiring changes to URL structures. It also works correctly with Views, multilingual content, and the Content Moderation module.
Features
- Provides a global "View any unpublished content" permission for viewing all unpublished nodes regardless of content type
- Automatically generates per-content-type permissions (e.g., "Article: View any unpublished content") for each content type
- Works alongside the core "view own unpublished content" permission without conflicts
- Integrates with Views using a custom "Published status or admin user" filter that respects the module's permissions
- Supports multilingual sites by properly handling language-specific node grants for translated content
- Automatically flags node access permissions for rebuild when installing or uninstalling the module
- Compatible with Content Moderation module's unpublished access permissions
- Integrates with the core Content overview screen (Administration > Content) to show unpublished content based on permissions
Use Cases
Editorial Workflow for News Sites
A news website needs editors to preview unpublished articles before publication, but shouldn't see unpublished landing pages managed by administrators. Assign 'Article: View any unpublished content' to the Editor role while withholding page-related permissions.
Content Review Teams
Different teams review different content types. The product team reviews product pages while the marketing team reviews blog posts. Grant each team only the permission for their content type (e.g., 'Product: View any unpublished content' for product team).
Client Preview Access
Clients need to review content before it goes live, but shouldn't have full administrative access. Create a 'Client Reviewer' role with 'View any unpublished content' permission to allow previewing all draft content without edit capabilities.
Integration with Override Node Options
Combined with the Override Node Options module, you can allow specific roles to both view and publish/unpublish certain content types without granting full node administration access.
Multilingual Content Preview
For multilingual sites, editors translating content need to preview unpublished translations. The module properly handles language-specific grants, allowing users to view unpublished translations in specific languages while published versions remain accessible to all.
Tips
- Always use the 'Published status or admin user' filter in Views to leverage view_unpublished permissions
- The module works without modifying URLs - unpublished content remains at its normal path
- Combine with the Override Node Options module for a complete editorial workflow solution
- Node access permissions are cached - clear caches if permission changes don't take effect immediately
- The module respects core's 'view own unpublished content' permission, so users can always view their own unpublished content if that permission is granted
- For sites using Content Moderation, the module integrates with the module's own unpublished access permissions
Technical Details
Permissions 2
Hooks 4
hook_node_access_records
Defines node access grants for unpublished content. Creates grants in multiple realms: 'view_unpublished_content' for global access, 'view_unpublished_{type}_content' for per-content-type access, and 'view_unpublished_author' for own content access.
hook_node_grants
Assigns node access grants to users based on their permissions. Checks for 'view any unpublished content' (global), 'view any unpublished {type} content' (per-type), and core's 'view own unpublished content' permissions.
hook_views_plugins_filter_alter
Replaces the core node_status Views filter plugin class with the module's custom NodeStatus class to properly handle view_unpublished permissions in Views.
hook_views_query_substitutions
Provides query substitution placeholders for Views that indicate whether the current user has permission to view unpublished content of each type.
Troubleshooting 5
Ensure you're using the 'Published status or admin user' filter in Views, NOT the 'Published (= Yes)' filter. The custom filter respects view_unpublished permissions while the standard filter does not.
Rebuild node access permissions at Administration > Reports > Status > Rebuild. This is required for the module's grants to be applied to existing content.
Check if the user has the global 'View any unpublished content' permission, which overrides per-type permissions. Remove this permission to use granular per-type access.
Node access rebuild can take significant time with large content volumes. Schedule the rebuild during off-peak hours and ensure adequate PHP memory and execution time limits.
This was a bug in earlier versions. Update to the latest version of the module, which automatically removes errant dependencies during updates (update hook 8002).
Security Notes 5
- This module intentionally expands access to unpublished content - carefully consider which roles should have these permissions
- Unpublished content may contain sensitive or unfinished information not intended for public viewing
- Per-content-type permissions are safer than the global permission for limiting exposure
- Review permissions regularly, especially after creating new content types, as new per-type permissions are automatically generated
- The module does not grant edit or delete access - only view access to unpublished content