It would be nice if the admin user (uid = 1) or a new permission (administer invites) could manage (resend, cancel, delete) existing invites.
Currently, the test is done on the connected user and the uid of the inviter, example : (line 1186, invite.module, function invite_cancel)

function invite_cancel(&$form_state, $origin, $code) {
  ...
  // Inviter must be the current user.
  if ($invite->inviter->uid == $user->uid) {
  ...
  }
  else {
    watchdog('invite', 'Detected malicious attempt to delete an invitation.', array(), WATCHDOG_WARNING, l(t('view'), 'user/'. $user->uid));
    drupal_access_denied();
  }
}

Why not doing this in the menu entry using access callback ?

Comments

James Andres’s picture

Version: 6.x-2.0-alpha1 » 6.x-2.0-beta3
Status: Active » Needs review
StatusFileSize
new4.21 KB

2 years on! Here is a patch that resolves this issue. Hopefully this work has not already been completed somewhere else..

dale42’s picture

Version: 6.x-2.0-beta3 » 6.x-2.x-dev
Issue summary: View changes
Status: Needs review » Closed (outdated)

I'm helping the Invite module maintainers by cleaning up old issues.

Drupal 6 is no longer supported so I'm setting the issue status to Closed (outdated). Information on what that means is here: Issue Status field.

If you have a question about one of the current versions of the module please do submit a new issue.