I love this module but when I was surfing around on my user accounts, I noticed that if I go to another users profile I can still see the join or leave role tab, and can edit it for them! I don't believe this should be possible. I think it just needs a simple patch so that only the user/owner of an account can view/change their role. Or if this was a chosen design please let me know.

CommentFileSizeAuthor
#5 join_role_with_password.module.1.2.1.patch1.76 KBfrancoud

Comments

snowbbdd’s picture

snowbbdd commented
Title: Souldn't be able to change other users role » Shouldn't be able to change other users role
Status: Active » Needs review

Fixed my version, and hopefully this will be put in the next update.

Changed line 59 in join_role_with_password.module from
$items['user/%user/join_role'] = array(

to

$items['user/%user/edit/join_role'] = array(

and ran update.php

francoud’s picture

francoud commented

As far as I can see, the module allows only the current user to join or leave a role.

If user nr. 2 goes to: /user/3/join_roles - he still affect only itself, no user 3's roles.

I agree is not elegant that user 2 can go to "/user/3/join_roles ". The correct url should be just
"/user/join_role", but it's just a matter of link visibility... i'll investigate furthermore.

Leeteq’s picture

Leeteq commented
Priority: Critical » Normal

If the actual edits only affect the current user anyway, regardless of the URL, then setting this to normal, not critical. And if so, then the fix should be relatively easy?

francoud’s picture

francoud commented

Thanks for setting this bug from critical to normal. I didnt notice it.

I can confirm: /user/%whatever/join_role always affects only the "current" user.

Actually, I just want that the "Join or leave a role" item appear together with "view" and "edit" tabs for the "my account" menu; it should appear for the current user only, but if I use $items['user/%user/join_role'] in the hook_menu call, it appears for any user; putting it inside the "edit"
also will lead to misunderstanding (user/edit/%whatever/join_role will, again, only affect the current user).

Still searching for an elegant solution. Any suggestion will be appreciated ;)

francoud’s picture

francoud commented
Status: Needs review » Needs work
StatusFileSize
new join_role_with_password.module.1.2.1.patch1.76 KB

I tried solving the problem with this patch. "trick" was: moving the "join or leave a role" link from the original place (now u find under the "profile" link), and forcing the "right" url. I tried and seems working, but maybe somebody could test it further. I post the "patch" that should lead to module version 1.2-1. Still not committing it - needs more testing...

note: patch applies to version 6 only!!

francoud’s picture

francoud commented
Assigned: Unassigned » francoud
Status: Needs work » Closed (fixed)

I didnt receive any comment, and my tests seem good. So i think u can use this patch if u need.

Leeteq’s picture

Leeteq commented

Will the patch be committed?