Hi,

I have a question on views access control. In my case, I have a views block, and a views tab page, and for both of them, the access plugin always return FALSE. My observation is that:

1) Login as site admin, I can see the views block, can not see the views tab page
2) Login as non-site admin, I cannot see both of them

I am confused by 1), since I expect the views block and views tab page have the same behavior for site admin.

So my question is that: are access control for views block and views page treated differently for site admin?

Say, the access check of views block for site admin will not be performed, while the access check of views page will be performed for all kind of users.

Thanks.

Comments

foredoc’s picture

foredoc commented

Any ideas?

Thanks

dawehner’s picture

dawehner
Primary language German
commented
Status: Active » Postponed (maintainer needs more info)

In general you shouldn't push issues like this, because the bug squad team works from last to first and so ....

If you really want help, then you should look what is on the issue create page:

Before submitting an issue to Views, you are responsible for reading and understanding the Views issue submission guidelines. Failure to read and understand this page will result in your issue being marked "won't fix".

http://drupal.org/node/571990

So please do it, it will help to understand you want to do, so we can help you.

foredoc’s picture

foredoc commented

Here is the detailed information:

1) I create a views access plugin, for testing reason, the return value of the access callback for this plugin is always FALSE, and I expected the views using this plugin always state un-accessible.

2) I create a views block, and views tab page. For both of them, I choose the previous created plugin for access control

3) In my current theme, I enable the views block, which is created in step 2)

Following are my observations:

1) if I login as site admin, $uid ==1; And I can see the views block showing up, and the views tab page is invisible.

2) If I login as a normal authenticated user($uid > 1 ), both the views block and the views tab are invisible.

My question is that,

since the views access check always return FALSE as designed, How could the views block showing up for site admin ?

And because both the block and tabpage are invisible for normal authenticated user, I have the feeling that views or drupal handles the access control differently for views block and views tabpage for Site Admin:

Access check for views block will not be executed for $uid == 1
And, Access check for views page will always be performed for all users.

Thanks.

merlinofchaos’s picture

merlinofchaos commented
Status: Postponed (maintainer needs more info) » Closed (works as designed)

Views uses a permission 'access all views' that bypasses access plugins. UID 1 automatically has all permissions, and anyone with a role that has that permission also will.

I actually hate this feature, myself, but it was added long ago because there is a clear belief that UID 1 should, in fact, bypass all access control. I think it's wrong, but expectations are what they are, and I eventually caved on this one. It is unlikely to change again.

foredoc’s picture

foredoc commented
Status: Closed (works as designed) » Needs work

Thanks.

I understand that "UID 1 automatically has all permissions".

However, I guess I have not make myself clear enough.

The problem is: views block and views tab page are acting DIFFERENTLY in my case.

For $uid==1, and views access callback return == FALSE

  Observation expectation
views block visible visible
views tabpage invisible ? visible

 

That's why I am confused.

foredoc’s picture

foredoc commented

Any ideas? Thanks.

metasj’s picture

metasj commented

did you enable the Views UI in admin/build/modules?

mustanggb’s picture

mustanggb commented
Issue summary: View changes
Status: Needs work » Closed (outdated)