Even though users haven't been assigned the "subscribe to content" permission, they are being subscribed to nodes they create. Further, since they haven't not been given permission to edit their subscription preferences, they cannot unsubscribe from these threads.
Looking at subscriptions_content_nodeapi() and _subscriptions_content_autosubscribe(), I don't see any permission checks. Not sure if this was by design -- I'm kinda surprised this hasn't been brought up before by other sites.
Attached is a patch that checks for 'subscribe to content' permission before autosubscribing the node author.
Two notes about the patch:
1. It only checks for the 'subscribe to content' permission. The logic might have to be smarter to deal with other permissions like subscribing by taxa or content type. Need your help on this, salvis.
2. It only autosubscribes a user on node insert if $user->uid == $node->uid. If the logged in user is not the assigned author of a node, no subscription is set for either $user->uid or $node->uid.
Thanks!
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | subscriptions.module-autosubscribe-permissions.patch | 1.01 KB | gregorygo |
| #1 | subscriptions_content-autosubscribe-1.patch | 705 bytes | gregorygo |
| subscriptions_content-autosubscribe.patch | 717 bytes | gregorygo |
Comments
Comment #1
gregorygo commentedOops, typo in patch. Try this one.
Comment #2
gregorygo commentedAttached is a patch for subscriptions.module to check for the 'subscribe to content' permission in subscriptions_autosubscribe().
This might be a better solution than the previous patches. (But it doesn't take into account cases where a node or comment is created on behalf of another user.)
Comment #3
salvisI agree, but I think we need to do more than that: if Autosubscribe is not available to the user, then he shouldn't see the Autosubscribe options.
Comment #4
salvisI decided to put the check into _subscriptions_content_autosubscribe(). The 'subscribe to content' permission specifically applies to content, so that's where we need to check.
subscriptions_autosubscribe() may be called by other modules that offer auto-subscribe functionality for items other than nodes.
#3 still holds, but we need to get this in. Committed to the D6 and D7 -dev versions (give it up to 12h to be repackaged). Thanks!