I'm using Drupal Drupal 4.6.2, 2005-06-29 (from CHANGELOG.txt) and flexinode 4/15/05 (from CHANGELOG.txt).

In Drupal's access control admin page, I had allowed Authenticated user to create and edit a specific flexinode content type. Later, in that content type's edit content type page, I changed the value of the Content type name. After the change, Authenticated user lost the ability to create and edit that content type.

Here's the strange part: To verify this bug I changed the Content type name value again and went back into the access control page. Same behaviour as above. But when I changed Content type name back to the previous value, Authenicated user could create and edit again.

I assumed that the content types are identified by their flexinode_type.ctype_id and not by their flexinode_type.name, but I'm not sure what's going on.

Comments

markj’s picture

markj commented

I just found out that the problem also applies to flexinode's tabular view and search results. The items I added under the original content type name are no longer available in the tabular view or by searching. They are still available when linked to directly and when searched using the sitewide search module.

If this is a bug then in effect it means that people shouldn't change a flexinode content type's name -- which is not what they are led to believe since that field is editable.

Bèr Kessels’s picture

Bèr Kessels commented
Category: bug » feature
Priority: Critical » Minor

This is a feature. And it is minor, not critical.

The way our permissions work in Drupal is with strings. We check for "Some string can Do Foo" as a permission. I.E we check for "edit foo content or "create Bar content".

If we would make the permissions "node name change safe" as you suggest, we would see permissions in ythe permission settings as "edit flexinde-23 content" instead of "edit news entry content".

We chose for the latter. with the downside of loosing the perms settings when changing the name.

this can be solved with a lot of code that updates the permission database table on changing a name.

markj’s picture

markj commented

If it's a feature, then there's still the critical (not minor) usability issue: people who change the content type's name will not be able to see the instances of the node they had in their table view and search results. Great feature.

Bèr Kessels’s picture

Bèr Kessels commented

PLease send in patches and not rants.

Rants will not fix anything, patches will.

ufku’s picture

ufku commented

if you use translations it has the same effect. since flexinode_node_name() returns the translated name of the content type, flexinode_access cant find the permissions in the permissions table.
my solution: define another function(ex.flexinode_node_name_en()) that returns the english name of the content type and replace "flexinode_node_name()"s with this function in flexinode_access().

Bèr Kessels’s picture

Bèr Kessels commented

We should find a nicer way to do this.
But first we must get flexinode ready for FormsAPI/4.7 then can we look at this.