The user_access() calls to check for permission to administer actions are underscored as administer_actions but shouldn't be to be consistent with other core permissions. Line 185 for actions_access_check looks at the non-underscored string, so should always fail.

Patch switches to administer actions (without underscore) and updates existing permission assignments to match it. It also corrects a few coder notices.

Comments

deekayen’s picture

Adding coder stuff wasn't very proper, so here's just the fix to the specific issue.

deekayen’s picture

Status: Needs review » Needs work

I grepped HEAD, DRUPAL-5, and DRUPAL-5--2 for "administer_actions" and didn't find anything.

However, thanks to you making me second guess myself in IRC, I'm now considering this as the SQL upgrade solution instead if querying out to PHP and re-querying an UPDATE for each role. I'd want to make sure REPLACE() works in pgsql, which would mean it might be a few days before I get my pgsql install back up.

UPDATE {permission} SET perm = REPLACE(perm, 'administer_actions', 'administer actions') WHERE perm LIKE '%administer_actions%';

The upside to the implementation in #1 is that $ret[] will show exactly which role ids were updated where just the above UPDATE won't say anything helpful if debugging. If you don't like the REPLACE() alternative anyway, I still think #1 is RTBC.

deekayen’s picture

Status: Needs work » Needs review
StatusFileSize
new1.46 KB

You were right, my patches keep getting better, but I've somehow managed to spend several hours on this issue, so I'm done now.

I like this one better than #1. Like I said, there are tradeoffs, but I think this one outweighs #1.

#1

  • $ret[] shows which roles were updated
  • don't have to worry about support for really old databases having REPLACE()

this one:

Tested once again on Drupal 5.9 with MySQL 5.0.51a and PostgreSQL 8.3.3. Some credit goes to morbus for inspiring me to take a quick glance at the access control permissions after I read his rant on "admin userpoints".

jvandyk’s picture

Status: Needs review » Fixed

Update works as advertised. Thanks; committed!

Anonymous’s picture

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.