I'm integrating rules with VBO. Essentially I'm allowing the user (a non-admin type so mostly view-only permissions) to check off a number of nodes, enter some comments, and then I'm trying to generate an email to a specific user or role. I've created a component to allow this.

I've been able to expose things to the point where the user gets the email form (to add comments), but upon clicking next, I get a permission denied error. Not sure where it's failing, but how would I go about adding permissions to allow a non-privileged user to have an email generated on their behalf including comments that they enter?

I'm including my rule below in case that's helpful. Is it because I'm using PHP to generate the body of my message? Reading http://drupal.org/node/1300058 leads me to believe that following that would result in one email for each selected node, which is not what I want.

Thanks.

{ "rules_merchandise_memo_request" : {
    "LABEL" : "Merchandise Memo Request",
    "PLUGIN" : "rule",
    "REQUIRES" : [ "php", "rules" ],
    "USES VARIABLES" : {
      "memo_request_items" : { "label" : "Merchandise Items", "type" : "list\u003cnode\u003e" },
      "memo_request_comments" : { "label" : "Comments", "type" : "text_formatted" }
    },
    "DO" : [
      { "mail_to_users_of_role" : {
          "roles" : { "value" : { "3" : "3" } },
          "subject" : "Memo Request Submitted",
          "message" : "[site:current-user] has made a memo request for the following items:\r\n\r\n\u003c?php\r\nforeach ($memo_request_items as $item) {\r\n  print_r($item);\r\n  echo $item-\u003etitle;\r\n}\r\n?\u003e"
        }
      }
    ]
  }
}

Comments

colin_young’s picture

colin_young commented

I've tracked the source of the error down to line 353 of ui.core.inc in the rules/ui folder.

    // Make sure the current user really has access to configure this element
    // as well as the used input evaluators and data processors.
    if (!user_access('bypass rules access') && !$this->element->root()->access()) {
      form_set_error('', t('Access violation! You have insufficient access permissions to edit this configuration.'));
    }

So now, what is "this element"? When I do dpm($this->element) I get a RulesActions object.

Is there some way that I can say "give role 'X' permission to execute rules component 'Y'"? It doesn't seem to me that what I'm trying to do is some sort of unusual use-case. There doesn't appear to be any exposed way around it, other than to grant the bypass_rules_access to the particular role, but I'd rather not do that since it is supposed to be a low-privilege role.

Is there some programmatic way to add the permission?

colin_young’s picture

colin_young commented

I needed to add a new permission:

    'execute component' => array(
      'title' => t('Execute rules components'),
      'description' => t('Execute component actions.'),

and test for it:

    if (!user_access('bypass rules access') && !$this->element->root()->access() && !user_access('execute component')) {
      form_set_error('', t('Access violation! You have insufficient access permissions to edit this configuration.'));
    }

in order to get past the insufficient access permissions. Obviously I'm short-circuiting some important access control with this code.

With some carefully placed dpm statements in _views_bulk_operations_entity_access, it appears that Views Bulk Operations thinks I'm updating the selected nodes. I suppose that there is no way for rules to communicate back to VBO that it isn't updating, so I'll have to figure out what I can do from the VBO end.

In general it seems as though my component requires update permissions on the nodes I'm "manipulating" in spite of the fact that I'm only trying to generate an email with the node ids. Is there some way to indicate that I'm only performing a read only operation?

derhasi’s picture

derhasi commented
Category: support » bug

I have the same issue. This has something to do with the PHP Input Evaluator. But in my case, I only use that to build the arguments of a count views condition. As the user has no right to use PHP, access for executing the component is denied.

derhasi’s picture

derhasi commented
Category: bug » support

Oh, sory, didn't intend to change the category.

fago’s picture

fago
Primary language German
Location Vienna
commented
Status: Active » Closed (duplicate)

see #1217128: limiting Rules components to specific permissions.

DaiHadi’s picture

DaiHadi commented

problem is PHP Code you used to generate message, usual users haven't PHP Code permission, and shouldn't have.
you can write a simple custom module and provide simple action to generate the message text, then use this action before message sending action.
before doing this test the rule execute process when you granted PHP Code permission to users other than administrators to make sure that there is no other problem.

mitchell’s picture

mitchell commented
Component: Miscellaneous » Rules Core

Updated component.