' . t('The user module allows users to register, login, and log out. Users benefit from being able to sign on because it associates content they create with their account and allows various permissions to be set for their roles. The user module supports user roles which establish fine grained permissions allowing each role to do only what the administrator wants them to. Each user is assigned to one or more roles. By default there are two roles anonymous - a user who has not logged in, and authenticated a user who has signed up and who has been authorized.') . '
'; + $output = '' . t('The user module allows site visitors to register, log in, and log out of the site. Visitors benefit from being able to log in because it allows them to post content under their own names. Administrators benefit from having logged-in users because they can create roles for different groups of users and establish permissions for those roles. Each user can then be assigned to one or more roles in order to grant the user access to various features of the site. Every site visitor is assigned to at least one role by default: anonymous — for a user who has not logged in, or authenticated — for a user who has both signed up for an account and who is currently logged in.') . '
'; $output .= '' . t("Users can use their own name or handle and can specify personal configuration settings through their individual My account page. Users must authenticate by supplying a local username and password or through their OpenID, an optional and secure method for logging into many websites with a single username and password. In some configurations, users may authenticate using a username and password from another Drupal site, or through some other site-specific mechanism.") . '
'; $output .= '' . t('A visitor accessing your website is assigned a unique ID, or session ID, which is stored in a cookie. The cookie does not contain personal information, but acts as a key to retrieve information from your site. Users should have cookies enabled in their web browser when using your site.') . '
'; $output .= '' . t('For more information, see the online handbook entry for User module.', array('@user' => 'http://drupal.org/handbook/modules/user/')) . '
'; return $output; case 'admin/user/user': - return '' . t('Drupal allows users to register, login, log out, maintain user profiles, etc. Users of the site may not use their own names to post content until they have signed up for a user account.') . '
'; + return '' . t('Drupal allows users to register, log in, log out, maintain user profiles, etc. Users of the site may not use their own names to post content until they have signed up for a user account.') . '
'; case 'admin/user/user/create': case 'admin/user/user/account/create': return '' . t("This web page allows administrators to register new users. Users' e-mail addresses and usernames must be unique.") . '
'; case 'admin/user/permissions': - return '' . t('Permissions let you control what users can do on your site. Each user role (defined on the user roles page) has its own set of permissions. For example, you could give users classified as "Administrators" permission to "administer nodes" but deny this power to ordinary, "authenticated" users. You can use permissions to reveal new features to privileged users (those with subscriptions, for example). Permissions also allow trusted users to share the administrative burden of running a busy site.', array('@role' => url('admin/user/roles'))) . '
'; + return '' . t('Permissions let you control what users can do on your site. Each role listed across the top of the table below (and configured on the user roles page) has its own set of permissions. For example, you could give users classified as "administrators" permission to "administer nodes" but deny this power to ordinary, "authenticated" users. You can use permissions to reveal new features to privileged users (those with subscriptions, for example). Permissions also allow trusted users to share the administrative burden of running a busy site.', array('@role' => url('admin/user/roles'))) . '
'; case 'admin/user/roles': - return t('Roles allow you to fine tune the security and administration of Drupal. A role defines a group of users that have certain privileges as defined in user permissions. Examples of roles include: anonymous user, authenticated user, moderator, administrator and so on. In this area you will define the role names of the various roles. To delete a role choose "edit".
By default, Drupal comes with two user roles:
+ return t('Roles allow you to fine tune the security and administration of Drupal. A role defines a group of users that are granted certain privileges in the user permissions section. Examples of common roles include: administrator, editor, moderator, content contributor, and so on. Below, you can add new roles or edit existing ones. When editing a role, you can choose to label it as administrative, which will allow modules to automatically grant this role certain permissions for convenience of administering the site. Only roles which are limited to trusted users should be labeled as administrative.
By default, Drupal comes with at least two user roles:
' . t('Enter a simple pattern ("*" may be used as a wildcard match) to search for a username or e-mail address. For example, one may search for "br" and Drupal might return "brian", "brad", and "brenda@example.com".') . '
'; Index: modules/user/user.test =================================================================== RCS file: /cvs/drupal/drupal/modules/user/user.test,v retrieving revision 1.27 diff -u -p -r1.27 user.test --- modules/user/user.test 31 Jan 2009 16:50:57 -0000 1.27 +++ modules/user/user.test 1 Feb 2009 16:27:49 -0000 @@ -713,13 +713,8 @@ class UserPermissionsTestCase extends Dr function setUp() { parent::setUp(); - $this->admin_user = $this->drupalCreateUser(array('administer permissions', 'access user profiles')); - - // Find the new role ID - it must be the maximum. - $all_rids = array_keys($this->admin_user->roles); - sort($all_rids); - $this->rid = array_pop($all_rids); + $this->rid = $this->drupalGetNewestRole($this->admin_user); } /** @@ -749,6 +744,75 @@ class UserPermissionsTestCase extends Dr } +class UserAdministrativeRolesTestCase extends DrupalWebTestCase { + function getInfo() { + return array( + 'name' => t('Administrative roles'), + 'description' => t('Verify that administrative roles can be added, removed, and assigned permissions.'), + 'group' => t('User') + ); + } + + /** + * Test that a role can be labeled and unlabeled "administrative" via the + * API and via the user interface. + */ + function testChangeAdministrativeRole() { + // Create a user and find the new role ID. + $admin_user = $this->drupalCreateUser(array('administer permissions')); + $rid = $this->drupalGetNewestRole($admin_user); + $this->assertFalse(drupal_is_administrative_role($rid), t('A newly created role is not labeled as administrative.')); + + // Test the API. + drupal_add_administrative_role($rid); + $this->assertTrue(drupal_is_administrative_role($rid), t('A role can be labeled as administrative via the API.')); + $this->assertTrue(in_array($rid, drupal_administrative_roles()), t('The role that was just labeled as administrative appears in the list of administrative roles.')); + drupal_remove_administrative_role($rid); + $this->assertFalse(drupal_is_administrative_role($rid), t('The administrative label can be removed from a role via the API.')); + $this->assertFalse(in_array($rid, drupal_administrative_roles()), t('The role whose administrative label was just removed does not appear in the list of administrative roles.')); + + // Test the user interface. + $this->drupalLogin($admin_user); + $edit_role_url = 'admin/user/roles/edit/'. $rid; + $this->drupalPost($edit_role_url, array('administrative_role' => TRUE), t('Save role')); + $this->assertTrue(drupal_is_administrative_role($rid), t('A role can be labeled as administrative via the user interface.')); + $this->drupalPost($edit_role_url, array('administrative_role' => FALSE), t('Save role')); + $this->assertFalse(drupal_is_administrative_role($rid), t('The administrative label can be removed from a role via the user interface.')); + } + + /** + * Test that permissions can be assigned to administrative roles via the + * API. + */ + function testAssignAdministrativePermissions() { + // Create three roles, two of which will be labeled as administrative. + $first_admin_user = $this->drupalCreateUser(); + $first_admin_rid = $this->drupalGetNewestRole($first_admin_user); + $second_admin_user = $this->drupalCreateUser(); + $second_admin_rid = $this->drupalGetNewestRole($second_admin_user); + $regular_user = $this->drupalCreateUser(); + + // Label the two administrative roles. + drupal_add_administrative_role($first_admin_rid); + drupal_add_administrative_role($second_admin_rid); + + // Check that none of the roles have the 'administer users' permission. + $perm = 'administer users'; + $this->assertFalse(user_access($perm, $first_admin_user), t('The first administrative user does not start off with the "@perm" permission.', array('@perm' => $perm))); + $this->assertFalse(user_access($perm, $second_admin_user), t('The second administrative user does not start off with the "@perm" permission.', array('@perm' => $perm))); + $this->assertFalse(user_access($perm, $regular_user), t('The regular user does not start off with the "@perm" permission.', array('@perm' => $perm))); + + // Now assign the permission, and check that only the users with + // administrative roles have it. + user_assign_administrative_permissions(array($perm)); + // Clear the static cache the first time we check, since permissions + // have changed. + $this->assertTrue(user_access($perm, $first_admin_user, TRUE), t('The first administrative user has the "@perm" permission after it has been assigned to all administrative roles.', array('@perm' => $perm))); + $this->assertTrue(user_access($perm, $second_admin_user), t('The second administrative user has the "@perm" permission after it has been assigned to all administrative roles.', array('@perm' => $perm))); + $this->assertFalse(user_access($perm, $regular_user), t('The regular user still does not have the "@perm" permission after it has been assigned to all administrative roles.', array('@perm' => $perm))); + } +} + class UserAdminTestCase extends DrupalWebTestCase { function getInfo() { return array( Index: profiles/default/default.profile =================================================================== RCS file: /cvs/drupal/drupal/profiles/default/default.profile,v retrieving revision 1.36 diff -u -p -r1.36 default.profile --- profiles/default/default.profile 14 Jan 2009 21:16:21 -0000 1.36 +++ profiles/default/default.profile 1 Feb 2009 16:27:49 -0000 @@ -145,6 +145,33 @@ function default_profile_tasks(&$task, $ ))->execute(); db_insert('taxonomy_vocabulary_node_type')->fields(array('vid' => $vid, 'type' => 'article'))->execute(); + // Create a role for site administrators so that modules can assign their + // administrative permissions to it. + $rid = db_insert('role')->fields(array('name' => 'administrator'))->execute(); + drupal_add_administrative_role($rid); + + // Assign some initial administrative permissions to this role. + $administrative_perms = array( + // Permissions for required core modules. + 'administer blocks', + 'administer filters', + 'administer content types', + 'administer nodes', + 'access administration pages', + 'access site reports', + 'administer actions', + 'administer files', + 'administer site configuration', + 'access user profiles', + 'administer permissions', + 'administer users', + // Permissions for other modules installed by this profile. + 'administer comments', + 'administer menu', + 'administer taxonomy', + ); + user_assign_administrative_permissions($administrative_perms); + // Update the menu router information. menu_rebuild();