I think it's not convinient for site owners to allow ad owners with only access statistics or access click history to edit ad. Only manage status and manage active ad should allow to edit that ad.
Sorry for not providing real patch but I'm away from computer with developer tools.
function ad_access($op, $node) {
global $user;
if ($op == 'create') {
return user_access('create advertisements');
}
if ($op == 'update' || $op == 'delete') {
return (user_access('administer advertisements') ||
(ad_is_owner($node->nid) &&
(ad_adaccess($node->nid, 'manage status') ||
ad_adaccess($node->nid, 'manage active ad'))));
}
}
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | ad.module.diff | 710 bytes | vito_swat |
Comments
Comment #1
jeremy commentedPlease attach a diff so it's possible to see what you're changing.
Comment #2
vito_swat commentedThis is really simple patch.
Comment #3
vito_swat commentedchanging status
Comment #4
jeremy commentedThe existing code only allows 1) an ad administrator, or 2) the owner of the ad with "manage advertisements" permissions to actually edit or delete the ad. Your patch would make it so any user with "manage status" or "manage active ad" permissions the ability to edit or delete any ad. This is problematic because you would no longer be able to give users control over specific ads. It also tries to move an ad_image-specific permission into the main ad module.
I will not merge your patch. The existing code is correct and will stay.
Comment #5
vito_swat commentedThis sentence is not true.
The patch checks if user is:
1) an ad administrator
2) owner of the ad and can manage ad status (I understand that s/he should be able to edit ad)
3) owner of the ad and can manage active ad (I understand that s/he shold be able to do everything with this ad)
So you are able to give users control over specific ads making them owners or not.
If existing code will stay you have no option at all to prevent some users (i.e. clients) from modifing and deleting your ads, because every user must have "manage advertisments" permission to become an owner. You don't have the possibility to show only i.e. statistics to users.
I don't insist the patch is fully corect (i don't follow what all the permissions are for) but it's behaviour is still better than actual code. In my opinion if owner can only see the statistics s/he shoudn't be able to edit this ad. Corrent me if I'm wrong.
Comment #6
jeremy commentedOkay, now I understand. You are requesting the ability to allow a user to view statistics without being able to edit the ad. Re-opening.
Comment #7
sunComment #8
jeremy commentedCode was committed so that by default, statistics and clicks are visible to all if the ad_permission module is not enabled. Once you enable the ad_permission module, then you have to configure this on a per-user per-ad basis.