Anyone else have this issue? The only way my users can view other users' relationships is if they have the 'administer users' permission from the user module set. Setting the permissions from the user relationship module doesn't make any difference at all, the only thing that works is setting 'administer users'. Anyone else seeing this?

Comments

ltwinner’s picture

Been digging through the code and here is what I know is happening

a) When I go to say a user/*/relationships page, the user_relationships_ui_check_access() function gets called twice.
The first time for /user/*/relationships

$items['user/%user/relationships'] = array(
    'title'             => t('Relationships'),
    'access callback'   => 'user_relationships_ui_check_access',
    'access arguments'  => array(array('admin', 'user'), 1),
    'page callback'     => 'user_relationships_page',
    'page arguments'    => array(1),
    'file'              => 'user_relationships_ui.pages.inc',
  );

and the second time for /relationships

$items['relationships'] = array(
    'title'             => t('My relationships'),
    'type'              => MENU_NORMAL_ITEM,
    'access callback'   => 'user_relationships_ui_check_access',
    'access arguments'  => array('view'),
    'page callback'     => 'user_relationships_page',
    'file'              => 'user_relationships_ui.pages.inc',
  );

b) The first access check where the arguments are 'admin' and 'user' returns false;
c) The second access check where argument is 'view' return true;

Yet even though members get true on the second access check they are still denied access to the page????

alex.k’s picture

alex.k’s picture

Category: bug » feature

In light of what's been done in the 5.x issue I would classify this one as a feature, not a bug. It seems the module was never designed to have the relationships page of other users be visible to non-admins.

With Views it's possible to replicate the /relationships page and much more... if you have trouble creating a view pls post back and we'll see what can be done. Thanks.

ltwinner’s picture

im not sure what you mean alex, has this bug/feature been corrected/implemented in the latest development snapshot or are you saying it hasn't and to use views to do the /relationships page? If you are saying to use views then I supposed the code for the /relationships page in the module is redundant?

As regards, "the module was never designed to have the relationships page of other users be visible to non-admins." that seems a bit strange for a social networking module as viewing a users' relationships page is a common feature of bebo, facebook, etc.

alex.k’s picture

Sorry, to clarify...
* It's not addressed in the 6.x branch
* I'd prefer that Views be used because flexibility of how the page looks is so much greater
* /relationships is not redundant, because in case of user's own relationships that is the place to manage their incoming requests, delete existing relationship and so on
Of course being able to see other users' friends is a basic ability, what I mean by "was never designed" is original author did not provide this functionality except though UR Blocks. So when I picked up the module it didn't have this ability, which I addressed by adding Views integration.

ltwinner’s picture

ok thanks for clarifying mate.

dmuth’s picture

Version: 6.x-1.0-beta10 » 6.x-1.0-rc3

If this functionality is to be deprecated (as per the comment in #5), would it possible to remove it from the module?

I just spent an hour pulling my hair out trying to get viewing another user's relationships until I stumbled across this page.

Thanks,

-- Doug

alex.k’s picture

Doug,

Viewing another user's relationships is definitely possible using Views. It just that the built-in page does not work for this purpose.

berdir’s picture

Status: Active » Closed (duplicate)

This is not going to happen for 6.x-1.x. Instead, see #1115998: Revamp core and UI permissions for the issue going *is* going to be commited to 7.x-1.x.