Hi,
I recently had an issue posted to FileField Paths #309339: CCK field access permissions, where the user was getting an error related to the use of FileField Paths and CCK Permissions.
I have a patch to fix the issue that is occurring in FIleField Paths, however it appears that the issue is occurring due to another issue that I suspect is related to FileField or CCK Permissions.
The issue is that the FileField Paths module was trying to process a empty FileField, however the user was using a user account that did not have access to the FileField in question and the FileField should not have been populating an array.
To see the alleged FileField issue in action:
- enable CCK, CCK Permissions, FileField and Devel
- create a FileField that has multiple values allowed on a node type
- create a user with access to create, edit and delete said node type, access to devel information but not access to the FileField
- place a dpm($node) inside a hook_nodeapi() 'presave' reference
- login as dummy user and create a node of the above node type
- Look at the dpm output you can see a populated FileField array
I know it may seems trivial, but I would assume that the FileField widget shouldn't be processing if it wasn't attached to the form.
Also possibly related to this issue is when you create a node that does have access to the FileField but don't upload a file it will still process the field and when you next edit the node there will be an extra FileField input added to the widget.
If you need further information I would be more than happy to help.
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | 203126.jpg | 77.75 KB | vnazarv |
Comments
Comment #1
dopry commentedSounds more like CCK shouldn't be loading the filefield data... I'll bounce this upstream and see what Karen and Yched have to say.
Comment #2
karens commentedThe permissions code doesn't avoid generating the field, it uses #access on the rendered item. Files may need different handling, but I don't have any particular ideas about how to implement it. Maybe you could look at that code and propose something.
Comment #3
vnazarv commented