access perms too strong at admin/content
hunmonk - April 16, 2007 - 00:46
| Project: | Drupal |
| Version: | 6.x-dev |
| Component: | node.module |
| Category: | bug report |
| Priority: | normal |
| Assigned: | hunmonk |
| Status: | closed |
Description
currently, the access perm for admin/content is 'administer site configuration'. now that the menu bubbling is gone, users cannot admin nodes unless they have both 'administer nodes' and 'administer site configuration' -- that's too much power to have to grant just to enable a user to admin nodes!
attached patch changes the menu perm for admin/content to the generic 'access administration pages', which i think is a more sensible perm level for that menu path
| Attachment | Size | Status | Test result | Operations |
|---|---|---|---|---|
| admin_content_perm.patch | 710 bytes | Ignored | None | None |
#1
Patch no longer applies.
# patch -p0 < admin_content_perm.patch
patching file modules/node/node.module
Hunk #1 FAILED at 1127.
1 out of 1 hunk FAILED -- saving rejects to file modules/node/node.module.rej
#2
updated patch attached.
#3
Tested and works. This makes a lot more sense. RTBC.
#4
Note that while menu links no longer "bubble", you *can* still make a link directly to admin/content/node and put it in the Navigation menu or a custom menu without this patch. The access to the page is not blocked, the user just can't see the link.
Actually a more sensible change for the permission might be to just remove that line. The user won't be able to see that link unless they have 'access administration pages', and this page will still inherit that permission from /admin. This makes more sense, otherwise users with 'administer comments', etc. won't be able to see their links without 'administer nodes' permission too.
However, we then need to apply the 'administer site configuration' permission to the RSS feed settings page, otherwise a user with just 'access administration pages' (or per the patch above, 'administer nodes') will be able to change the feed settings at admin/content/rss-publishing.
#5
per feedback from chx on IRC - patch above is a bad idea, since then users may see a link to an empty page. This patch combines the two above - admin/content requires 'administer nodes' while admin/content/rss-publishing now explicitly requires 'administer site configuration' (before it inherited it from admin/content).
#6
logic in the issue is sound, patch is clean (applies with minor offset), tested and works as expected. important bug fix. definitely RTBC.
#7
Committed!
#8