I'm the maintainer of Drupal Administration Menu.

If a user has not the administer site configuration permission, she does not see the proper menu structure that has been introduced in Drupal 5. In particular, the following menu items are not displayed due to wrong access permissions:

  • Content management (should be access administration pages)
  • Site building (should be access administration pages)
  • User management (should be administer users)

The attached patch fixes the access permissions for those menu items.

CommentFileSizeAuthor
drupal.access-permissions.patch2.88 KBsun

Comments

sun’s picture

Component: base system » menu system
Status: Needs review » Needs work

It seems that just fixing those particular access permissions is not enough. Under certain circumstances those grouping menu items should not be displayed. Example:

A user does not have any permission to administer stuff below 'Site building'.

In a case like this, access permissions need to be inherited backwards, i.e. only if one child item is accessible then the parent item has to be accessible, too. That check is only needed for menu item groupings.

As a temporary fix for admin_menu I've inserted this snippet:

  $mid_admin = $_menu['path index']['admin'];
  
  // Temporary access permissions fix for root menu items until #126621 is committed to core.
  foreach ($_menu['items'][$mid_admin]['children'] as $key => $parent) {
    if ($_menu['items'][$parent]['access'] != false || !isset($_menu['items'][$parent]['children'])) {
      continue;
    }
    $is_accessible = false;
    foreach ($_menu['items'][$parent]['children'] as $key => $child) {
      if ($_menu['items'][$child]['access'] == true) {
        $is_accessible = true;
      }
    }
    if ($is_accessible) {
      $_menu['items'][$parent]['access'] = true;
    }
  }

This might be helpful for fixing this issue in the menu system of Drupal 5, but I've no clue about how and where to fix this. If anyone has some helpful hints I probably could code a patch to fix this issue.

sun’s picture

Version: 5.x-dev » 6.x-dev

Setting correct version.

pancho’s picture

Wow, this seems to be the right direction to eliminate a very annoying behaviour that partly ruins the rather fine-grained permissions system.
I'll take a closer look at it asap to come up with a patch, and even then we'd need extensive testing, but I think this should go into D6.
Some input on the principle would be appreciated!

sun’s picture

While a similar issue for Drupal 5 has been marked won't fix, contrib modules like admin_menu still need some ugly workarounds to circumvent these wrong permissions in the menu system of Drupal 5.
However, due to the new menu system, I was not yet able to port admin_menu for D6. Thus, I cannot tell whether those bugs still exist.

pancho’s picture

The bug still exists, as it seems to me. I try to follow up with something.

ahoria’s picture

just want to touch this to refresh the thread, the issue feels quite critical
is this solved in D6?
which workaround is ok to use in D6?

thanks

sun’s picture

Status: Needs work » Closed (duplicate)