It would be nice if the admin user (uid = 1) or a new permission (administer invites) could manage (resend, cancel, delete) existing invites.
Currently, the test is done on the connected user and the uid of the inviter, example : (line 1186, invite.module, function invite_cancel)
function invite_cancel(&$form_state, $origin, $code) {
...
// Inviter must be the current user.
if ($invite->inviter->uid == $user->uid) {
...
}
else {
watchdog('invite', 'Detected malicious attempt to delete an invitation.', array(), WATCHDOG_WARNING, l(t('view'), 'user/'. $user->uid));
drupal_access_denied();
}
}
Why not doing this in the menu entry using access callback ?
Comments
Comment #1
James Andres commented2 years on! Here is a patch that resolves this issue. Hopefully this work has not already been completed somewhere else..
Comment #2
dale42I'm helping the Invite module maintainers by cleaning up old issues.
Drupal 6 is no longer supported so I'm setting the issue status to Closed (outdated). Information on what that means is here: Issue Status field.
If you have a question about one of the current versions of the module please do submit a new issue.