Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Administering apache solr search is set to 'administer site configuration'. But since this module requires the search module and it has a more define set of search access control, it should be using that instead. I think it should be set to
'access' => user_access('administer search'),
on line 18 and 24 of apachesolr.module.
| Comment | File | Size | Author |
|---|---|---|---|
| #15 | access-299539-15.patch | 7.2 KB | pwolanin |
| #13 | access-299539-13.patch | 6.17 KB | pwolanin |
| #9 | access.patch | 354 bytes | kleung11 |
| #2 | adminsearch.patch | 1005 bytes | kleung11 |
Comments
Comment #1
JacobSingh commentedAgreed. Can you submit a patch for this?
Comment #2
kleung11 commentedPatch attached.
Comment #3
kleung11 commentedComment #4
JacobSingh commentedHey folks,
I just committed this one because it was so trivial and obvious. Feel free to revert if there is any issue.
Thanks kleung!
Comment #5
robertdouglass commentedI'd feel best if we ported things like this immediately.
Comment #6
JacobSingh commentedComment #7
JacobSingh commentedComment #8
Anonymous (not verified) commentedAutomatically closed -- issue fixed for two weeks with no activity.
Comment #9
kleung11 commentedapache delete index should also check "administer search" instead. Trivial patch included.
Comment #10
pwolanin commentedplease post diffs in unified (-u) format
Comment #11
JacobSingh commentedI think we decided to go back to "administer site configuration" for the following reasons:
1. We don't want to require the search module at some point (although we still do).
2. Creating more perms is a PITA for new users.
That being said, I can see a use case where someone at an org can modify boosting params, but cannot see everyone's social security #s. SO I'm actually in favor of doing this.
I'll make a patch, but what do people think?
a). use administer search (thereby requiring search module as long as we do this).
b). use a new permission like "administer apachesolr"
c). leave it as is.
Best,
Jacob
Comment #12
pwolanin commentedGiven that we depend on the search module, we should probably use 'administer search' for most of this. Possibly "delete index" should still be limited?
Comment #13
pwolanin commentedComment #14
janusman commentedMissed a line in apachesolr.admin.inc:
Otherwise, it works.
Comment #15
pwolanin commentedfixed code comment. Committing to 6.x