Closed (fixed)
Project:
Webform
Version:
7.x-3.17
Component:
Code
Priority:
Normal
Category:
Support request
Assigned:
Unassigned
Reporter:
Created:
11 May 2012 at 16:42 UTC
Updated:
28 May 2012 at 17:51 UTC
When I try to create a menu that lists live links for nodes the user has access to, and shadow "links" for those s/he doesn't, it works swimmingly with regular nodes, but not with webforms. All webforms seem to return "1" in menu_link_load($mlid))[access] regardless of whether the user actually has access to them or not. The result, in my case, is live links that take users to a page with a message that they don't have access to view this webform.
Whatever special access control system Webform uses internally, it would be great if it passed the correct access information to core functions.
Comments
Comment #1
quicksketchHm, I'm not sure why this is. The menu system is also responsible for denying access to the page once you click on the link, so I would have thought that it would properly report access to the node before you get to the page also. To clarify further, I also don't think Webform is informing the node_access() function incorrectly, as the return value from node_access() works fine also.
Poking around the menu system, I *think* this may be because Webform does not specify a "to arg" function in hook_menu(). I unfortunately can't really say I know how that menu property is supposed to work, so this may take a little research. Here's the function that does the access checking in the menu system:
http://api.drupal.org/api/drupal/includes%21menu.inc/function/_menu_link...
Comment #2
bbinkovitz commentedI'm getting the same incorrect values from node_access() as I am from menu_link_load()[access].
Comment #3
quicksketchWait, is this actually a "message" set by drupal_set_message()? Perhaps you're not talking about node access control at all, and you just have specified that a particular user role doesn't have access to view the form. Access to viewing the form is different than access to the node page (in the event that you might want to "close" a form but keep the URL active for historical purposes for example).
Comment #4
bbinkovitz commentedYou're right. I confused access to submit the form with access to view the node. Sorry, and thanks for your attention to the matter.
Comment #5
quicksketchGreat, glad we got it sorted out.