Attachments are Disabled on Book Pages

I think this has to do with the d.o. upgrade.

This code was in the drupalorg.module before the upgrade even, and it did not change a bit (therefore removing tag):

  // List of forms to check for overrides, and the corresponding permissions.
  $override_forms = array(
    'book_node_form'       => 'edit book pages',
    'forum_node_form'      => 'administer nodes',
    'page_node_form'       => 'administer nodes',
    'simplenews_node_form' => 'create newsletter',
    'story_node_form'      => 'administer nodes',
  );
  // Override the access for attachments if it's a forbidden form,
  // and the user does not have sufficient permissions.
  if (in_array($form_id, array_keys($override_forms)) && !user_access($override_forms[$form_id])) {
    if (isset($form['attachments']['#access'])) {
      $form['attachments']['#access'] = FALSE;
    }
  }

Not sure who added it and why, but you can make out the exact required permissions for each node type. Maybe with the more fine-grained permissions in D6, we can update/revise this list.

This is a bug which came up after the upgrade. I have Docs Team and Site Maintainer roles, and when I edit a book page now I cannot upload attachments anymore.

Can anybody from the Docs team confirm this? Please check if you can attach files to book nodes. Tnx

As said in #2 above, the code is the same, but the sets of available permissions changed from 5 to 6.

the new perm name should be 'book_node_form' => 'edit any book content'

I don't have time to make a patch. we should also remove the simplenews line since we aren't using it anymore. moving this to the webmasters queue queue so we can get this fixed asap. (I tried to put it in the drupalorg.module queue but it didn't come up in the Project autocomplete.)

It's not a proper patch, but I don't know where or if I can get access to the drupal.org custom module source code. Please make the change add1sun recommends to the drupalorg.module so that attachments are enabled for book pages:

   // List of forms to check for overrides, and the corresponding permissions.
   $override_forms = array(
-    'book_node_form'       => 'edit book pages',
+    'book_node_form'       => 'edit any book content',
     'forum_node_form'      => 'administer nodes',
     'page_node_form'       => 'administer nodes',

FYI, drupalorg module lives in contrib CVS, just like everything else:
http://drupal.org/project/drupalorg
http://drupal.org/node/185188/cvs-instructions
http://drupal.org/cvs?file=/modules/drupalorg/drupalorg_project/drupalor...

BTW, this code in drupalorg.module was from the D5 days when there was no way to give fine-grained access control to what node types users are allowed to upload files to. Once we changed project_issue to use the upload and comment_upload modules, there was no way to give authenticated users permission to attach files to issues without giving them the blanket "upload files" permission. But, that'd let all authenticated users attach files to forums and book pages, too, which was deemed undesirable. So, we added this code in here to prevent access except for special users on certain forms. So, this *is* a bug from the d.o upgrade, since the permissions changed and this code was never ported to D6...

Given that, the change proposed in #7 is (I believe) incorrect. That's going to give all auth users the permission to attach files to book pages. Do we really want that? Seems like we should check for a permission here that only the special Doc team folks have, since auth can now "edit any book content". Seems like being on the doc team now just gives you the power to "revert revisions". Should we tie this feature to that permission for the purpose of editing book pages?

Wow, this is a stupid bug. I just lost 10 minutes searching fervently around trying to figure out why I couldn't see this field, why even though it was enabled at admin/content/types/book I *still* couldn't see it, etc. I shudder to think at how many critical resources are off on some external server somewhere that could fall off the Internet at any time because of it. :(

I spoke with Addi. Apart from access to the Documentation input format, the only other difference is 'revert revisions' permission, so that's what the patch is based on.

If we could fast-track this commit, that would be wonderful.

Yep, I'm cool with this and agree that we need this in sooner rather than later. It had fallen off my radar but this is crippling to docs.

Escalating to critical because:

a) The current behaviour is completely broken. The "edit book pages" permission doesn't exist anymore, and as a result Dries Buytaert is the only person who can upload images on book pages on Drupal.org. :P

b) This represents a major roadblock to any kind of serious documentation work. I'm in IRC with someone right now who wants to add a tutorial to the handbook with 32 screen shots. His options are either link to the images off-site, or upload them to groups.drupal.org/the issue queue. Both of which are completely stupid.

Oops. Cross-post reset status.

Committed to HEAD + DRUPAL-6--1, and applied locally on d.o. This should be deployed for real via SVN, but I didn't feel like importing the whole thing just for this change.

Awesome!! Thank you so much, dww! :D

Thanks, much appreciated webchick and dww.

Officially deployed...