A user with only the create reservations permission can alter the start and end of a reservation that is in the checked out state as well as delete the node.

A user with only create reservations shouldn't even be able to edit a reservation in a confirmed status.

Comments

darrick’s picture

Can you be more clear with this.

Currently a user with the "create reservations" permission can edit there own reservations only if the status is MERCI_STATUS_UNCONFIRMED.

If the user also has the 'create confirmed reservations' status then they can edit any of their own reservations regardless of the reservation status.

    elseif (user_access('create reservations') and !user_access('suspend MERCI access')) {
      //users working with their own reservations access reservation
      //additional check in merci_form permission to edit confirmed reservations
  // Users without administer or manage reservations permission can only alter their own Unconfirmed Reservations.
      if ($op == 'edit' && isset($node->merci_reservation_status)
        && $node->merci_reservation_status != MERCI_STATUS_UNCONFIRMED
        && !user_access('create confirmed reservations')) {
          return FALSE;
      }

      if ($uid === FALSE || $uid == $account->uid) {
        return TRUE;
      }
    }

darrick’s picture

Status: Active » Fixed

'edit' is not a valid operation passed to hook_access.

http://api.drupal.org/api/drupal/developer--hooks--node.php/function/hoo...

$op The operation to be performed. Possible values:

"create"
"delete"
"update"
"view"

kreynen’s picture

That bug was introduced between beta10 and 11 with this commit...

http://drupalcode.org/project/merci.git/commit/f9ff10db35021a1f3ca67954b...

http://drupalcode.org/project/merci.git/blobdiff/91feedd747b225faff1f789...

Testing the reamaining issues from DOM and BAVC against current code today.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

rashedctg’s picture

Category: bug » support
Status: Closed (fixed) » Active

Hi

I am a new programmer and need help with MERCI. I have the same problem. I need the user to only be able to view the reservation and not be able to edit the reservations they make.

Is there a way to remove the "Edit" tab from the reservation form when the user has the "create reservations" permission and the user reserve equipments.

Thanks

darrick’s picture

Status: Active » Closed (fixed)

@rashedctg please do not reopen issues which have nothing to do with the same question you've already posted ten times.

rashedctg’s picture

well I did not post anything ten times and what am I supposed to do if the question is not answered.

kreynen’s picture

Please read the "Getting an issue addressed sooner" section of the handbooks http://drupal.org/node/73178

No one is being paid to answer these question or fix these issues. Darrick and I contribute to MERCI because it works for us and the organizations we work with. It is free for you to use "as is", but there is never a guarantee that it will have every feature you want or be easy enough for every user to configure.