The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.In the case where a node is owned by the user, do not assert MNE rules.
| Comment | File | Size | Author |
|---|---|---|---|
| #8 | 552418-na.patch | 5.36 KB | agentrickard |
| #7 | 552418-node-access.patch | 2.83 KB | agentrickard |
| #5 | 552418-node-access.patch | 2.59 KB | agentrickard |
| #4 | 552418-node-access.patch | 2.2 KB | agentrickard |
| #2 | menu_node_edit.module.patch | 1.44 KB | benkewell |
Comments
Comment #1
agentrickardAnd a patch.
Comment #2
benkewell commentedi came into this issue when i found that MNE rules overrided the 'edit any x-type content' permission provided by core node module.
users who have the 'edit any x-type content' permission cannot edit any x-type content except those within their sections.
after investigating into the code, it is found that in menu_node_edit_check_rules(),
user_access('administer nodes', $account) is used to check for allowed permission,
and this prevents 'edit own x-type content' and 'edit any x-type content' from working
i changed menu_node_edit_check_rules() to use node_access('update', $node, $account) instead,
so that any permission allowed by other modules would precede MNE rules.
i believe it is a better solution as it ensures that more general permissions can be granted.
attached is the patch for the issue, which is working well on my website.
notice that in order to make it work,
the argument passed to menu_node_edit_check_rules() is changed from $nid to $node.
Comment #3
agentrickard[Edit]
Hm. I misread that patch. You may be right. If node_access() says TRUE, we don't care about our rules. But the way the patch is written, we then call node_access() twice.
Maybe we can optimize that by changing the return value from
menu_node_edit_check_rules().FALSE if we don't have a say, and TRUE if node_access() is TRUE. Return an array() otherwise.
Comment #4
agentrickardHere's a patch that does so. This eliminates the extra calls to node_access().
Comment #5
agentrickardMissed a change from $nid to $node.
Comment #6
benkewell commentedyour change is reasonable.
i tested #5 patch and is working fine.
i believe the patch is ready to commit to release.
Comment #7
agentrickardThere was a logic error in it. Sometimes (the case of 'edit any X in my sections', node_access() will return FALSE, but we want to return TRUE.
The attached corrects that and adds more optimization, so we never check user perms (which is expensive) unless we absolutely must.
Comment #8
agentrickardCleaned up and committed to HEAD.