Closed (outdated)
Project:
Content locking (anti-concurrent editing)
Version:
7.x-2.x-dev
Component:
User interface
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
15 Sep 2011 at 20:30 UTC
Updated:
26 Nov 2024 at 09:54 UTC
Jump to comment: Most recent, Most recent file
Comments
Comment #1
jaydub commentedI would agree that another user shouldn't be able to view the locked documents tab of another user unless they have the administer locks permission. Furthermore the help text for this path (user/%/content_lock) has hardcoded the word 'you' in the string 'Below is a list of all documents locked by you...'
The attached patch adds a menu access callback to only allow menu access if user has the admin permission or the logged in user has the check out documents permission AND is viewing their own locked documents tab page (user/%/content_lock).
Comment #2
bulldozer2003Sorry I just tested this patch today. After patching, the locked documents tab still appears when users with "check out documents" are viewing another user, except now they can see the list of locked documents! The release lock option is just not available.
Comment #3
jaydub commentedDid you happen to clear the cache by chance as the menu would probably have to be rebuilt...I'll try to take another look.
Comment #4
bulldozer2003You might be right, but rather than "clear the cache" I just checked again right now 6 days later. I assume the cache cleared itself in the interim. Thanks!
Comment #5
pandaski commentedComment #6
astonvictor commentedI'm closing it because the issue was created a long time ago without any further steps.
if you still need it then raise a new one.
thanks