I am using 'one state workflow' for image types in Plone, and it appears an anonymous user can still see an image even if it's 'publishing date' is set in the future...
Is 'publishing date' ignored in 'one state workflow' for images?
It also appears 'expiry date' is also ignored ie it appears when you dial up its url.
Note: I am accessing the image direct via it's URL eg my.site.com/assets/images/myexpiredimage
Perhaps these publish/expiry dates only useful for listings and collections etc, they dont control access and visibility?
Tried to find good Plone doco on this but couldn't... happy for a link to where this is explained?
Yes, these things do nothing about people who have the URL, ever, regardless of workflow. The best quote for this I could find in three minutes is hidden in the user manual glossary.
Setting the publication- or expiration-date merely means the item will not show up in listings (navi-elements, search results, folder-listings), and is not to be confused with workflow-states.
A better solution would be to change the wf-state, when a date is met via a cron, which can be done quite comfortably with collective.contentrules.comingsoon.
Yet you need to rip out the default-behaviour of the concerned templates, I'm not sure, but maybe there is a proposal ("PLIP") already going on for this, if you find one, please leave the link here.
Refs: Control access on future content and How to retract content after expiration date
来源：https://stackoverflow.com/questions/27118425/plone-image-visibility-with-one-state-workflow