I added a menu item to the navigation menu. A registered user without any access to the wishlist module sees the menu item "Add to wishlist" (/node/add/wishlist). Clicking on the link shows the "No access" error page.
I would expect that the "add to wishlist" menu item would be hidden from the menu.

The "/wishlist" menu item that I created behaves like I expect: it doesn't show up for the registered user without wishlist access, but it does show up for registered users with wishlist access.

The "/node/add" drupal page only shows the "page" possibility (that is the only thing the registered user without wishlist access is allowed to do).

I did look at the php wishlist.module coding and found out that the hook_access api has changed from D5 to D6 (param $account was added) and that the wishlist.module uses only two params, but I don't think that is the cause of this issue.

Carl

Comments

ashokc’s picture

ashokc commented

This happens with another CCK content type that I created. Create Content shows this type to a user, even while that use does not have access to create content of that type.

scott.mclewin’s picture

scott.mclewin commented
Status: Active » Postponed (maintainer needs more info)

As near as I can tell this is done correctly. the node/add/wishlist page is automatically generated by Drupal.

The wishlist module associates the 'create wishlists' permission against that menu item here

function wishlist_menu_alter(&$callbacks) {
    $callbacks['node/add/wishlist']['access callback'] = 'user_access';
    $callbacks['node/add/wishlist']['access arguments'] = array('create wishlists');
}

Unless there is a typo I've not spotted in this, or there is a more appropriate method, I am at a loss to explain or solve the behavior you described.

scott.mclewin’s picture

scott.mclewin commented
Status: Postponed (maintainer needs more info) » Closed (cannot reproduce)