I wonder if you deliberately do not call nodequeue_api_subqueue_access() in nodequeue_node_tab(). The result is that all subqueues are shown in the table, even if they can not be manipulated by the user.

nodequeue_api_subqueue_access() gets called by:
1) nodequeue_node_tab_access(), to determine access to the nodequeue tab; and
2) nodequeue_admin_view(), to list all subqueues that the user can manipulate.

The latter functionality should ideally also be used on the nodequeue tab of an individual node.

Comments

ezra-g’s picture

ezra-g commented
Status: Active » Closed (works as designed)

By calling nodequeue_api_subqueue_accesss in nodequeue_tab_access we prevent subqueues from being displayed when the user does not have access to them. I am unable to recreate the condition where users see subqueues to which they do not have access, on this tab.

If I am mistaken, please contact me directly via my contact form as this would constitute a security issue and this issue should be unpublished.

Thanks.