Hi there,

Moderation forms a key aspect of a project I'm working on at the moment, so I spent some time improving (I hope!) the modr8 module in order to beef up the moderation capabilities somewhat. Here's what I achieved:

  • Replaced the 'Pending moderation' message with a 'minimod form', that includes the 'Pending moderation' message along with two 'Approve' and 'Delete' links.
  • The former goes to node/[nid]/approve, which is a new menu handler.
  • The latter goes to node/[nid]/delete, the standard deletion-confirm form. Because of this it's necessary to perform the logging of a deleted node in modr8_nodeapi('delete'), which has the added effect that if you delete a node in moderation through Administer -> Content or clicking 'Delete' on the node's edit page, the logging still gets done. I see this as an advantage.
  • Added a 'publish content unmoderated' permission which allows users to create content that doesn't automatically go into the moderation queue.

I'd love to hear your feedback on my additions, and perhaps even get a few of them installed. Unfortunately diff's output was a bit rubbish in this case, but I've attached it nonetheless.

CommentFileSizeAuthor
modr8.diff23.22 KBdmhouse

Comments

pwolanin’s picture

pwolanin commented
Status: Active » Needs review

haven't looked in detail yet- I'l not sure abot the mini-form, but catching other deletion events is probably useful

dmhouse’s picture

dmhouse commented

Any further progress on this issue? Have you had a chance to review the additions yet?

pwolanin’s picture

pwolanin commented
Status: Needs review » Needs work

taking action (approve) based on a GET is considered bad due to possible XSFR, so I don't want to include that.

The permission is something I have resisted adding, since this can be accomplished with a trivial additional module and the simple case is not going to satisfy more complexes uses (e.g. allow X role to post Y content type with Z taxonomy term without moderation).

The patch seems to encompass the whole file - which makes me think you changed the line ending or white space or some such. Can you re-make the diff with the -w flag if necessary?

I'd also like to keep the 5.x and 6.x basically in sync in terms of features. The main thing I think would be a boon would be keeping a record in the log of nodes that were directly deleted (and sending e-mail too?).

moshe weitzman’s picture

moshe weitzman commented

You can add a token to your links and then check the token before taking action. This protects against CSRF and has been in our API since we added form tokens. Both nodequeue and OG use this technique. FYI.

pwolanin’s picture

pwolanin commented

@moshe - sure that's possible too. but in both cases this misses the opportunity to e-mail a message.

EvanDonovan’s picture

EvanDonovan commented

For our purposes on www.urbanministry.org, since we want to have a "lower tier" level of editors, who we trust to publish content without moderation, but not to moderate others' content, the "publish content unmoderated" permission would be an invaluable feature to have.

pwolanin, would it be possible to extract that functionality from this patch and add it to 5.x-2.4? It's hard for me to tell, since the diff seems to encompass the whole file. If the diff were clearer, I might be able to add the functionality to my copy of the module, even if it doesn't make it into the official release.

I do think it would be useful for others, however.