User autocomplete also requires 'access user profiles' permission
pips1 - June 25, 2009 - 12:12
| Project: | Content Management Filter |
| Version: | 6.x-1.7 |
| Component: | Code |
| Category: | bug report |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | closed |
Description
AJAX search by author name works fine as superuser (user/1) and other roles I defined.
However, AJAX search by author name doesn't work for any role that doesn't have the permission 'admin cmf module'. By comparison, the 'search by author list' works just fine for that role.
I would have expected that users can use both 'search by author list' and 'search by author name' equally, as long as they have the permissions 'view user content list' and 'filter and manage site content'.
On a side note, this made me wonder what the permission 'admin cmf module' is used for in the first place. See separate support request: #501900.
#1
The latest -dev code no longer has 'admin cmf module' and I am unable to reproduce this problem. If you can, please, confirm that this is no longer an issue, then mark this issue "fixed."
#2
I see that 'admin cmf module' is now gone in permissions. Ok, fine, if that didn't do anything in the first place. :-)
However, the "live search" (AJAX search) for 'title/subject' (new feature of 6.x-1.7) and 'user name' still only works for the superuser (/user/1). For any other (custom created) role, I don't get any available node titles / user names listed by the live search...
For comparison, I tested the live search of the cck nodereference with those roles, and the live search works just fine.
Can anyone reproduce this at all?
#3
#4
I just discovered that live search for 'title/subject' (new feature of 6.x-1.7) doesn't work with the superuser role either.
(However, the 'user name' works for the superuser).
#5
Here's a picture from my user/3 showing content selected with the "title/subject" filter. And I assure you that I tested it before committing it. BTW, I don't think the "title/subject" filter uses Ajax.
#6
Hi Nancy, thanks for looking into this. Please have a look a the two attached screenshots.
#7
#8
In order to use the user/autocomplete function, a user must have the 'access user profiles' permission. So, there are three ways to go here:
I sort of lean towards #2 because of potential security issues, but #1 would not be all that hard to accomplish. While #3 is not hard, I am very concerned about that.
The "title/subject" filter is not an autocomplete. You simply enter a string and the filter will find all nodes/comments with that string.
#9
Changing title.
#10
Fix committed to 6.x-1.x-dev. Will be ported to 5.x.
I went with option #1, which means that you will need to rebuild the menus (or clear cache).
#11
Committed to 5.x-1.x-dev
#12