Users with "can lock" (and not adminster locks) see the "Locked documents" tab on other users' profile pages. No locks are displayed unless user has administer locks permission, but I don't think the locks tab should be displayed on other user's profiles unless user viewing has adminster locks permission.

CommentFileSizeAuthor
#1 menu_access_handler-1280830-1.patch1.88 KBjaydub

Comments

jaydub’s picture

Version: 7.x-1.1 » 7.x-1.x-dev
Status: Active » Needs review
StatusFileSize
new1.88 KB

I would agree that another user shouldn't be able to view the locked documents tab of another user unless they have the administer locks permission. Furthermore the help text for this path (user/%/content_lock) has hardcoded the word 'you' in the string 'Below is a list of all documents locked by you...'

The attached patch adds a menu access callback to only allow menu access if user has the admin permission or the logged in user has the check out documents permission AND is viewing their own locked documents tab page (user/%/content_lock).

bulldozer2003’s picture

Status: Needs review » Needs work

Sorry I just tested this patch today. After patching, the locked documents tab still appears when users with "check out documents" are viewing another user, except now they can see the list of locked documents! The release lock option is just not available.

jaydub’s picture

Did you happen to clear the cache by chance as the menu would probably have to be rebuilt...I'll try to take another look.

bulldozer2003’s picture

Status: Needs work » Reviewed & tested by the community

You might be right, but rather than "clear the cache" I just checked again right now 6 days later. I assume the cache cleared itself in the interim. Thanks!

pandaski’s picture

Version: 7.x-1.x-dev » 7.x-2.x-dev
Issue summary: View changes
Status: Reviewed & tested by the community » Needs work
astonvictor’s picture

Status: Needs work » Closed (outdated)

I'm closing it because the issue was created a long time ago without any further steps.

if you still need it then raise a new one.
thanks