as of 5.x-1.4, this module does a very poor job implementing any permissioning of the functions it implements. the attached patch adds some nuance to this, creating a second permission ("ask questions") which allows users to create new question nodes, to go alongside "manage questions" which allows users to answer and update them.

CommentFileSizeAuthor
#2 question.317412.patch1.15 KBspiderman
question.permissions-fix.patch1.07 KBspiderman

Comments

nancydru’s picture

nancydru
she/her/hers
Primary language English
Location Boston
commented

I recently ran into problems with hook_access, so I recommend you go back and look at http://api.drupal.org/api/group/node_access/6. It is probably wrong to do something like "return user_access('ask questions');" for "op=update". That code could return false, denying access that might have been granted by an access control module. Other than "op=create," hook_access probably should not return false.

spiderman’s picture

spiderman
he/they
Primary language English
Location Halifax, NS
commented
StatusFileSize
new question.317412.patch1.15 KB

Thanks for the clarification- I hadn't realized this subtle distinction of hook_access. Attached is a freshly rolled patch which returns NULL in case the user doesn't have permissions, to allow the node_access table to remain in play.

codepoet’s picture

codepoet commented
Assigned: spiderman » codepoet

This is in -dev. Working on a final 5.x version before the 6.x version.

codepoet’s picture

codepoet commented
Status: Needs review » Fixed

Tagged 1.5 with this. Last 5.x version if all goes well.

Anonymous’s picture

Anonymous (not verified) commented
Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.