Users having the edit state "allowed" and edit own "allowed" able to view other users' unpublished articles?

[fabio42170]

Steps to reproduce the issue

1. Created a user group "TLLCER" composed of 2 users (students) belonging to the Authors group, with "edit state" and "edit own" set both to allowed.
2. Created a category called "students posts". When the users belonging to the "TLLCER" group use the frontend editor, they have no choice but to publish in this category.
3. Created a menu link called "my articles" pointing to the category list "students posts". When a user clicks on this link in the menu, they are redirected to publishing information. I made a test with the 2 users:

• user 1 (TLLCE1) submitted an article called "test student 1".
• user 2 (TLLCE2) submitted an article called "test student 2".
  user-test.jpg

Expected result

As the articles are pending for publication (by the administrator), users should not be able to view the unpublished articles submitted by the other user. So, user 1 should only be able to view his own article, and edit it until it is finally approved by the admin.

Actual result

User 1 can view user 2's article title, click on it, read it but not modify it.
User 2 can view user 1's article title, click on it, read it but not modify it.
Users 1 and 2 can view the administrator's unpublished articles (!!) in any categories. (of course they can't modify them but they should not have access to these articles at all)
Example of an unpublished article created by the administrator

System information (as much as possible)

Joomla! 5.1.4 Stable [ Kudumisha ] 27-August-2024 16:00 GMT
PHP version 8.2.21
MySql version 8.0.37-29

Additional comments

This bug / limitation (?) is a real problem when you wish to give users publishing rights on the front end. At the moment, there is no way to allow users to have a personal dashboard which would enable them to visualize their own pending for publication / unpublished articles. A real system allowing article visible per user should be the staple for a CMS boasting publishing functionalities for quite some years now.

[brianteeman]

To do what you want to do you need to create custom workflows - that is exactly what it is designed for. It is not possible using the default permissions

[fabio42170]

Thanks Brian.
I will spend some time working out a way to use the stages / transitions. The workflow system rather looks like a way to process the different stages of publication. Yet, will it solve my earlier problems:

• will it allow preventing users from viewing the other users' (from the same group) unpublished items in the category which I defined for them?
• will it allow preventing users at one moment of the stages / transitions (not sure about the difference right now) from having access to MY unpublished articles?
  I'd like to get an idea before investing lots of time devising the whole thing.

  ---

  _{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/44190.}

[fabio42170]

Hey Brian,
I tested the workflow and that's only sad news.
The worflow does not allow article viewing per user. Meaning that the worflow is just here to process the steps I described above step by step, which is not what I needed most in my case. I just have 1 stage: from the student creating his article to me publishing it. And Joomla does already offer the possibility to do it without the workflow system.

So, to make you understand what I did:

1. I created the workflow
2. I created 2 stages: the draft (created by the student, and allowing him/her to modify their article as long as they wish before they transition it to the super user) and the publication (made by me, the super user)
3. I created 1 transition: from draft to publication
4. I associated one category called student posts
5. The user group being allowed to create articles (thanks to a menu link on the front end) has the following permissions: everything is disallowed except for "create", "edit own", "edit state" and "transitions"

When testing - SAME issue:
Expected result
As the articles are pending for publication (by the administrator), users should not be able to view the unpublished articles submitted by the other user. So, user 1 should only be able to view his own article, and edit it until it is finally approved by the admin.
Actual result
User 1 can view user 2's article title, click on it, read it but not modify it.
User 2 can view user 1's article title, click on it, read it but not modify it.
Users 1 and 2 can view the administrator's unpublished articles (!!) in any categories. Of course they can't modify them but they should not have access to these articles at all and this is absolutely nonsensical to me. 😬
Eventually another problem is present: once the article has been published by the super user, the original author of the article should not be allowed to modify it anymore. Well, they can! 😣

SO, workflow is NOT the solution and I'm left stranded for something that should make sense for a CMS. It should be feasible.
So, either it is a bug and that has to be solved or it has to become the most awaited for feature. I do not want my users to be able to view other viewers'productions not until they are validated by me. Or else there might be a workaround? but this thread has been going on in the community for a few years now without any solutions provided for the moment. (last one being: https://forum.joomla.org/viewtopic.php?f=839&t=1011667). There are no extensions providing this feature at the moment, as they all rely on Joomla's native user permissions system.

I then really need your eye.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/44190.}

[brianteeman]

I guess Joomla is not suitable to your needs then

[fabio42170]

ok, that must be it!

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/44190.}

[rdeutz]

What you need is a view level like view own. We don't have that. I am converting this into a discussion. Thats the right place to define what is needed in detail.

[fabio42170]

Thank you @rdeutz. Yep, indeed, what I'd like to have is a view level called "view own" but a real one, no matter if the user is in or out of the concerned level access. Meaning that if the user belongs to one specific group of users, switching "view own" to allowed should allow him to see his own articles and other users from the same group should not be allowed to view his content. "view own" should reflect what the phrase exactly means (=view your own article), but in fact it is access level reliant.
Actually, there's - for the moment - no workaround. Joomla is helpless on that point, though the viewing access levels are a wonder. I don't want to turn away from Joomla because the whole lot of it is so powerful. But that would be a great improvement to see such a feature appear in the next versions. Joomla 6?