I added node links which toggle published/sticky/promoted. the links appear on every node view. this is for exercising very fast editorial decisions, when reading a site. we will use this on groups.drupal.org.

I refactored the node_status() function so it worked for all node options.

great module!

CommentFileSizeAuthor
patch_1873.43 KBmoshe weitzman

Comments

kkaefer’s picture

kkaefer commented

Thanks! Comitted to CVS with some modifications:

  • Replaced node_access() with user_access() because these settings don’t depend on the user’s ability to update the node but on the “administer nodes” permission
  • Converted the GET callbacks to POST and added confirmation pages if the user doesn’t call the page via POST
kkaefer’s picture

kkaefer commented
Status: Needs review » Fixed
moshe weitzman’s picture

moshe weitzman commented
Status: Fixed » Active

clicking on a node link, i see the confirm form also calling theme('page') so I get a drupal page within a page. i will try to debug more.

note that you can avoid confirm form and still be safe from CSRF by using tokens on the links. i thought that info would be on http://drupal.org/node/89999 but it isn't.

thanks for committing this so fast.

moshe weitzman’s picture

moshe weitzman commented

i think the technique is just to check with drupal_valid_token() when you receive the request to toggle.

kkaefer’s picture

kkaefer commented
Status: Active » Fixed

Moshe confirmed on IRC that the double page error was due to a cached script and that this error is now gone.

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)