Closed (duplicate)
Project:
Drupal core
Version:
6.x-dev
Component:
menu system
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
10 Mar 2007 at 23:20 UTC
Updated:
13 Jan 2009 at 15:04 UTC
I'm the maintainer of Drupal Administration Menu.
If a user has not the administer site configuration permission, she does not see the proper menu structure that has been introduced in Drupal 5. In particular, the following menu items are not displayed due to wrong access permissions:
The attached patch fixes the access permissions for those menu items.
| Comment | File | Size | Author |
|---|---|---|---|
| drupal.access-permissions.patch | 2.88 KB | sun |
Comments
Comment #1
sunIt seems that just fixing those particular access permissions is not enough. Under certain circumstances those grouping menu items should not be displayed. Example:
A user does not have any permission to administer stuff below 'Site building'.
In a case like this, access permissions need to be inherited backwards, i.e. only if one child item is accessible then the parent item has to be accessible, too. That check is only needed for menu item groupings.
As a temporary fix for admin_menu I've inserted this snippet:
This might be helpful for fixing this issue in the menu system of Drupal 5, but I've no clue about how and where to fix this. If anyone has some helpful hints I probably could code a patch to fix this issue.
Comment #2
sunSetting correct version.
Comment #3
panchoWow, this seems to be the right direction to eliminate a very annoying behaviour that partly ruins the rather fine-grained permissions system.
I'll take a closer look at it asap to come up with a patch, and even then we'd need extensive testing, but I think this should go into D6.
Some input on the principle would be appreciated!
Comment #4
sunWhile a similar issue for Drupal 5 has been marked won't fix, contrib modules like admin_menu still need some ugly workarounds to circumvent these wrong permissions in the menu system of Drupal 5.
However, due to the new menu system, I was not yet able to port admin_menu for D6. Thus, I cannot tell whether those bugs still exist.
Comment #5
panchoThe bug still exists, as it seems to me. I try to follow up with something.
Comment #6
ahoria commentedjust want to touch this to refresh the thread, the issue feels quite critical
is this solved in D6?
which workaround is ok to use in D6?
thanks
Comment #7
sunMarking as duplicate of #296693: Restrict access to empty top level administration pages