The permissions as set up do not allow someone other than the administrator to be given control of brilliant-gallery.

In brilliant_gallery.module line 46 should read:
return array('access brilliant_gallery', 'access administration pages');
not
return array('access brilliant_gallery');
as in the original. The additional permission is used to control access to admin pages, but not declared, so can never be granted.

Regards, Tony.

CommentFileSizeAuthor
#7 370747-bg-overwrite-permission-D6-3.patch3.35 KBdave reid

Comments

smartmark’s picture

smartmark commented
Priority: Normal » Critical
Status: Active » Reviewed & tested by the community

Thanks! I knew there were something wrong with setting access to "manage galleries". This fix should be included in the next release, too.

vacilando’s picture

vacilando commented
Status: Reviewed & tested by the community » Fixed

Thanks for locating this; applied to dev a few moments ago.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Status: Closed (fixed) » Active

This has not been fixed in the DRUPAL-6--3 branch yet and absolutely needs to be fixed soon. It is *very* bad for this module to be accidentally replacing system.module's permission so we couldn't find it on the admin/user/permissions page.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented

It isn't fixed in DRUPAL-6--4 yet either.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented

Actually, this needs to be *fixed*. It should be 'administer brilliant gallery' not 'access administration pages'. Huge, huge no-no.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Status: Active » Needs review
StatusFileSize
new 370747-bg-overwrite-permission-D6-3.patch3.35 KB

Patch against the 6.x-3.x branch.