Function 'user_load()' not international language ready

Modules use user_access() not user_roles() to look up permissions, since given roles cannot be assumed on the site. Looking into user_access() it does not care about the textual name of the role, but only about the key (internal role id).

Which modules do you see using user_roles()?

Ok, seeing this at http://api.drupal.org/api/function/blogapi_metaweblog_new_media_object/6. Since the role numbers are only what is ever used in the function later, that function should just intersect the array keys, not the array values.

Something like:

  $roles = array_intersect(array_keys(user_roles(FALSE, 'administer content with blog api')), array_keys($user->roles));

  foreach ($roles as $rid) {
    // unchanged
  }

Can you try this change out? (Marking as patch needs review, although I've only described the required changes).

Once this is validated to work, it should be ported to both the core blogapi module and whatever descendants it has.

It probably would be best to fix in user_load() as well, but that would require validation of all core and at least critical contributed module code where $user->roles or a derivative/copy/excerpt of $user->roles is used, so that it also assumes a translated role name.

Here is all direct use of ->roles in Drupal 6 core:

$ grep -r "\->roles" *
includes/bootstrap.inc:  $user->roles = array();
includes/bootstrap.inc:  $user->roles[DRUPAL_ANONYMOUS_RID] = 'anonymous user';
includes/file.inc:    foreach ($user->roles as $rid => $name) {
includes/session.inc:    $user->roles = array();
includes/session.inc:    $user->roles[DRUPAL_AUTHENTICATED_RID] = 'authenticated user';
includes/session.inc:      $user->roles[$role->rid] = $role->name;
modules/block/block.module:        $rids = array_keys($account->roles);
modules/block/block.module:    $rids = array_keys($user->roles);
modules/block/block.module:      $cid_parts[] = 'r.'. implode(',', array_keys($user->roles));
modules/blogapi/blogapi.module:  $roles = array_intersect(array_keys(user_roles(FALSE, 'administer content with blog api')), array_keys($user->roles));
modules/filter/filter.admin.inc:      if (strstr($format->roles, ",$rid,")) {
modules/filter/filter.admin.inc:    $checked = strstr($format->roles, ",$rid,");
modules/filter/filter.module:      foreach ($user->roles as $rid => $role) {
modules/upload/upload.module:  foreach ($user->roles as $rid => $name) {
modules/user/user.module:    $user->roles = array();
modules/user/user.module:      $user->roles[DRUPAL_AUTHENTICATED_RID] = 'authenticated user';
modules/user/user.module:      $user->roles[DRUPAL_ANONYMOUS_RID] = 'anonymous user';
modules/user/user.module:      $user->roles[$role->rid] = $role->name;
modules/user/user.module:    $result = db_query("SELECT p.perm FROM {role} r INNER JOIN {permission} p ON p.rid = r.rid WHERE r.rid IN (". db_placeholders($account->roles) .")", array_keys($account->roles));
modules/user/user.module:        if ($account !== FALSE && !isset($account->roles[$rid])) {
modules/user/user.module:          $roles = $account->roles + array($rid => $role_name);
modules/user/user.module:        if ($account !== FALSE && isset($account->roles[$rid])) {
modules/user/user.module:          $roles = array_diff($account->roles, array($rid => $role_name));
modules/user/user.module:      $account->roles = array(DRUPAL_AUTHENTICATED_RID => 1);

Here is a patch version of the above suggestion for review.

This needs to be fixed in D7, then backported.

By the way, we should really use array_diff_keys() here.

Do you know if this has been integrated into the WLW module as yet? I am running into the same file upload bugs now as was described earlier, and have used what I thought was the most recent WLW blog api plugin.

Damien was right this needs to be fixed in D7 first.

D7 i18n makes me worry about update.

Damien was right in July 2009, but in April 2010 blogapi module is no longer in core.

Is there any interest in this issue?