As a follow up to #1627020: No accessible menu item if only 'Access the content overview page' permission is granted, we should not be overriding the access of the view with views access plugins. This should be inherited from the system menu item that the view is using.

Comments

damiankloip’s picture

I guess this may be being overridden in the execute_hook_menu() method?

sun’s picture

I think the override/replacement actually happens in the views_menu_alter() code that runs after all view::execute_hook_menu() methods have been invoked to collate router items. Tough to override. :-/

damiankloip’s picture

Status: Active » Needs review
StatusFileSize
new3.41 KB

ok, so I think this one would be a bit of a pain. Here is one way we could do this, I'm not sure about this approach as any additional logic is in the system plugin and not in the access plugin. So I think this is pretty questionable anyway...

The access plugin is used just to determine what we should do, and provide a bit of metadata. If any of this logic goes into the access handler it doesn't really work too well. I guess this is to do with views and it's menu_alter. I think it leads to some recursion issues.

This patch does work though ;)

Status: Needs review » Needs work

The last submitted patch, 1697902-3.patch, failed testing.

sun’s picture

Is the access plugin required? This should be the default behavior and only behavior. At least I cannot see why an admin-view would want to legitimately override/replace the router path access handling of the original item. The patch makes it look like we're already able to copy/retain the access definition?

damiankloip’s picture

Yes, the current patch allows you to use any access plugin as normal if desired, as well as the menu one. Maybe some use cases will want to easily change/override this without having to menu_alter it?

Otherwise, we can re factor the code to only do that I guess.

sun’s picture

Yeah, that's basically exactly my thinking -- The system display handler replaces an existing router item. If anyone wants to alter the router item, then he should use the known way for doing so; i.e., hook_menu_alter(). Injecting/adding a separate layer of access definitions, overrides, and alter hooks can only lead to problems (e.g., the admin-view uses its hard-coded permission instead of the actual definition in the router item, so any module that adjusts it, is tripped up).

Ideally, we should even go one step further and disable/remove the access configuration for views using the system display, so that this cannot even be configured in the Views UI. However, I don't know whether that is possible.

damiankloip’s picture

sun, ok - that sounds like a plan. Leave that with me :) I think we MIGHT be able to remove the access from the UI, not totally sure off the top of my head though :?

damiankloip’s picture

Status: Needs work » Needs review
StatusFileSize
new2.84 KB

So maybe we could do this?

Quite alot of the execute_hook_menu can be removed I think. I have tested this and seems to be working ok. I have also removed the access selection from the UI, I think this is the only way we can do this tbh.

Status: Needs review » Needs work

The last submitted patch, 1697902-9.patch, failed testing.

damiankloip’s picture

StatusFileSize
new0 bytes

Hopefully this is better, and will atleast apply.

damiankloip’s picture

Status: Needs work » Needs review
damiankloip’s picture

StatusFileSize
new704 bytes

bah!

damiankloip’s picture

StatusFileSize
new2.64 KB

And it get's worse! Sorry....

sun’s picture

StatusFileSize
new5.98 KB

Actually, you might have been right with your original approach. However, for different reasons ;) (The access plugin code does not work, but I've documented what it is supposed to do)

damiankloip’s picture

StatusFileSize
new10.16 KB

ok, lets go with the plugin.

I've updated the patch to include the other views, I've also removed the get_access_callback() method in the access_menu plugin as I'm not sure it makes sense in there.

What do you think?

sun’s picture

+++ b/admin_views_default/taxonomy.admin-content-taxonomy.inc
@@ -13,14 +13,14 @@ $view->base_table = 'taxonomy_term_data';
-$view->disabled = TRUE; /* Edit this to true to make a default view disabled initially */
+$view->disabled = FALSE; /* Edit this to true to make a default view disabled initially */

Let's revert this to disabled.

+++ b/plugins/views_plugin_display_system.inc
@@ -111,47 +111,16 @@ class views_plugin_display_system extends views_plugin_display {
+    // @todo Not required here, but we need to enforce the 'menu' access plugin for all admin_views.
+    // $access_plugin = views_get_plugin('access', 'menu');

Any idea how we can resolve that?

+++ b/plugins/views_plugin_display_system.inc
@@ -246,6 +215,11 @@ class views_plugin_display_system extends views_plugin_display {
+    // Disable access plugin in the UI.
+    // @todo Views plugins seem to be able to enforce options programmatically.
+    // $categories['access']['build']['#pre_render'] = array('devel_render');
+    $categories['access']['build']['#access'] = FALSE;

Actually, right before I uploaded my patch, I checked some of the other display plugins in Views, and based on those it appears to me that it should be possible for a display plugin to disable/hide + perhaps even enforce certain settings for itself.

I.e., it's possible that we don't need to hack + hide the access settings this way...

damiankloip’s picture

StatusFileSize
new9.97 KB

ok, I think we are getting closer :)

I didn't mean to have the taxonomy view enabled, oops.

This patch adds the default value for the access plugin to the option_definition, if we also set "$view->options['defaults']['default']['access'] = FALSE;" as the feed plugin does for example, the defaults from the master aren't populated. This then enforces the menu plugin to be used for all system views and cannot be changed.

I think setting the #access to FALSE on the access category in options_summary might be the best place to remove this, as it is here that stuff like the ui column used etc... is defined.

I think it might be another patch, but I think we can safely remove get_pager_text() from the display handler, as this is identical to it's parent.

sun’s picture

Status: Needs review » Fixed

Thanks for reporting, reviewing, and testing! Committed to 7.x-1.x.

A new development snapshot will be available within the next 12 hours. This improvement will be available in the next official release.

sun’s picture

err, forgot to mention that I adjusted/rewrote the code comments ;)

damiankloip’s picture

Fair enough :) This is a good one to get in.

damiankloip’s picture

Do you get that issue fixed message from dreditor or something?

sun’s picture

Dreditor doesn't support it yet, I'm using the MyWords add-on for Firefox. We have a docs page for collecting and optimizing stock responses: http://drupal.org/node/467548

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

Anonymous’s picture

Issue summary: View changes

Updated issue summary.