I have a flag with Flag access by content authorship set to Users may only flag comments by others. When I add a this field to a view using (flag) Flags: Flag link, it always displays, even when the user is viewing their own content. When the user clicks on the flag link, it correctly says that they can't flag it, but it shouldn't show up at all.

CommentFileSizeAuthor
#1 flag-link-views-field-permissions-1925220-2.patch590 byteskielni

Comments

kielni’s picture

kielni commented
StatusFileSize
new flag-link-views-field-permissions-1925220-2.patch590 bytes

Here's a patch that checks $flag->access($content_id) before outputting the flag link

kielni’s picture

kielni commented
Status: Active » Needs review

set to needs review

joachim’s picture

joachim commented
Version: 7.x-2.0 » 7.x-3.x-dev
Status: Needs review » Postponed (maintainer needs more info)

Access is already checked in:

    $this->flag_applies = $ids ? $flag->access_multiple($ids) : array();

Is that access check failing, and how?

kielni’s picture

kielni commented

Yes, it's failing because the calls to check the access are different.

pre_render calls $flag->access_multiple($ids)

and I added this to render: $flag->access($content_id)

access has this additional code that's not in access_multiple

$access_array = module_invoke_all('flag_access', $this, $content_id, $action, $account);

which calls flag_flag_access. In my case, this denies permission for a user to flag their own comment. That's why it looked like it wasn't checking permissions; I guess a better patch would be to make the flag_access call from access_multiple also?

joachim’s picture

joachim commented

$flag->access_multiple() invokes hook_flag_access_multiple(). At least it does on 3.x.

If you want this on 2.x, you can find the issue and backport it, though at this point it would be more expedient to help get us to a 3.0 release :)

ivnish’s picture

ivnish
he/him
commented
Assigned: kielni » Unassigned
Issue summary: View changes
Status: Postponed (maintainer needs more info) » Closed (outdated)

Closed as outdated because Drupal 7 is EOL