FeedAPI does not offer any permission control over _refresh_ and _remove items_ tabs on a feed.
Rather than creating a new permission I suggest to use 'advanced feedapi options' for this. I know that this change might entail some users complaining about unexpected behavior after upgrading and ask for a separate permission. I think we should try to keep it simple and stick with existing permissions nevertheless.
Patch to come soon.
| Comment | File | Size | Author |
|---|---|---|---|
| #6 | 331063-6_feedapi_protect_refresh_remove.patch | 2.11 KB | aron novak |
| #4 | 331063-4_feedapi_protect_refresh_remove.patch | 1.63 KB | aron novak |
| #1 | 331063_feedapi_protect_refresh_remove.patch | 937 bytes | alex_b |
Comments
Comment #1
alex_b commentedComment #2
alex_b commentedComment #3
aron novakUnfortunately the patch is not suitable. _feedapi_op_access argument is a nid, not a string.
If you'd achieve what you imagined, 'access callback' => '_feedapi_op_access', lines should be removed also.
I'm not sure that changing the behaviour of the modue at this point is not too painful for the users.
Comment #4
aron novakFixed the issue mentioned in #3. Also added the proper notification to the CHANGELOG.txt. This is a big change.
Comment #5
alex_b commented#4 - doesn't this patch make the refresh and remove tabs show up on all nodes for users with advanced feedapi permissions?
Comment #6
aron novak#5, yep, fixed.
Comment #7
alex_b commented#6: I am not sure whether why you did the patch that way, an optional argument should not be necessary. Reviewing this patch again, I think we're going down the wrong route: we allow users who own a feed and who have 'edit own' permissions to refresh and purge their feeds.
If we'd like to have some sort of a global refresh/purge option, we should use 'administer nodes' as the permission. This would be consistent with using the 'edit own' permission.
Need to think better about this. Not critical for next release.