Showing unpublished content to the anonymous creator I am working on a Drupal 7 module called Anonymous Publishing.  In brief: It lets the anonymous user create posts.

The anonymous user create contents using the standard content creation node_form.  When the user press save, Drupal automatically creates and loads the node.  However, since the node is unpublished at this point, the user just gets an access denied message.  I want to avoid this, and instead show the user the node just created.  I've so far only managed to do this with this rather nasty kludge in a hook_node_grants():

$result = db_query("SELECT created FROM {node}
   WHERE nid = :nid", array(':nid' =&gt; $nid))-&gt;fetchField();
$delta = time() - $result;
if ((0 == $account-&gt;uid) &amp;&amp; ($delta &lt; 20)) {
  $grants['anonymous_publishing'] = array(1);
}
return $grants;


What the above code does is this: It checks the age of the node, and if it was created less than 20 seconds ago, it grants the anonymous user the right to view it.

While this works (sort of) it is ugly and it may even expose the content to someone else if there is another anonymous user around that requests the content within the same 20 second window.

Any suggestions for a better solution?
You can (relatively) safely store per-user data for anonymous users in $_SESSION. So if you intercept the node page view callback and add some extra code in there for the case in question (falling back to the core function), you should be able to achieve what you are after.

To elaborate: when you save the node in question, save its ID and an expiry timestamp in an array in the session, via a hook_node_insert. In the new callback check if that entry exists and has not expired. If present, fetch the node and display it. Otherwise call the regular node view callback.