Acess control should be set to follow search module
kleung11 - August 25, 2008 - 04:12
| Project: | Apache Solr Search Integration |
| Version: | 6.x-1.x-dev |
| Component: | Code |
| Category: | feature request |
| Priority: | minor |
| Assigned: | JacobSingh |
| Status: | closed |
Description
Administering apache solr search is set to 'administer site configuration'. But since this module requires the search module and it has a more define set of search access control, it should be using that instead. I think it should be set to
'access' => user_access('administer search'),
on line 18 and 24 of apachesolr.module.
#1
Agreed. Can you submit a patch for this?
#2
Patch attached.
#3
#4
Hey folks,
I just committed this one because it was so trivial and obvious. Feel free to revert if there is any issue.
Thanks kleung!
#5
I'd feel best if we ported things like this immediately.
#6
#7
temp
Automatically closed -- issue fixed for two weeks with no activity.
temp
Automatically closed -- issue fixed for two weeks with no activity.
#8
Automatically closed -- issue fixed for two weeks with no activity.
#9
apache delete index should also check "administer search" instead. Trivial patch included.
#10
please post diffs in unified (-u) format
#11
I think we decided to go back to "administer site configuration" for the following reasons:
1. We don't want to require the search module at some point (although we still do).
2. Creating more perms is a PITA for new users.
That being said, I can see a use case where someone at an org can modify boosting params, but cannot see everyone's social security #s. SO I'm actually in favor of doing this.
I'll make a patch, but what do people think?
a). use administer search (thereby requiring search module as long as we do this).
b). use a new permission like "administer apachesolr"
c). leave it as is.
Best,
Jacob
#12
Given that we depend on the search module, we should probably use 'administer search' for most of this. Possibly "delete index" should still be limited?
#13
#14
Missed a line in apachesolr.admin.inc:
// This form can't be seen by anyone without 'administer site configuration'Otherwise, it works.
#15
fixed code comment. Committing to 6.x
#16
Automatically closed -- issue fixed for 2 weeks with no activity.