When
* menu-admin-per-menu is installed (another great ux module),
* klicking on a menu item's "select content" at admin/structure/menu/manage/add_existing_content?some-parameters
* and the user does not hate "administer menu" permission for all menus (but has permission for the menu in question via menu-admin-permenu)
we get an "access denied".
this is because the view in content_menu.selectionviews.inc has 'administer menu' as hardcoded permission.
solving this needs some rethinking of the selection view.
in my opinion, as the view shows published content, the correct permission is 'View published content' (access content).
| Comment | File | Size | Author |
|---|---|---|---|
| #1 | 0001-fixed-1615242-selectionview-permission.patch | 1.13 KB | geek-merlin |
Comments
Comment #1
geek-merlintrivial patch attached.
what i did not test yet is if the corresponding action has the correct permission settings though.
Comment #2
geek-merlinComment #3
simon georges commentedUsing this permission means that everybody could go to this page, and click on links that they shouldn't, so even if the action has the correct permission, the link would return a 403, and people could be surprised / annoyed.
Moreover, the Views implementation has recently changed, so patch doesn't apply any more.
Let's see if we manage to fix this another way during the sprint next week.
Comment #4
danielnolde commented#3 sounds like this has to be refactored.
The patch looks very (perhaps too) simplistic, and keep in mind that other views can be configured to be used. Perhaps the permissions check has to be moved from the default view's code in to the module's main code files?
Would be nice if you can get this to works properly, Axel, since this sounds like a good addition to both modules.
Comment #5
Jeana_with_a_j commentedI'm just chiming in my support for this fix. My use case is that I have limited the access to menus based on roles and I can't have certain roles have access to all of the menus, only their section of the site. Menu_admin_per_menu is a fantastic fix for that. And I love the interaction that content_menu provides, but for now I have to disable content_menu since they are unable to add existing content to the menu.