Closed (won't fix)
Project:
Page Title
Version:
6.x-2.x-dev
Component:
Code
Priority:
Normal
Category:
Feature request
Assigned:
Unassigned
Reporter:
Created:
25 Feb 2010 at 20:23 UTC
Updated:
27 Jul 2016 at 12:59 UTC
Jump to comment: Most recent, Most recent file
Comments
Comment #1
BrandTim commentedPatch attached. Note that this patch does not honor Page_title's permissions; someone with the permission to Migrate will be able to put data into the newly created nodes' page titles regardless of whether or not they have permission from Page_title.
Tim Knittel
Comment #2
BrandTim commentedForgot to change the status to 'needs work.'
Tim Knittel
Comment #3
cedarm commented@BrandTim - actually permissions are respected due to checks surrounding the database queries, but this breaks drush migrate integration.
Seems to me it's wrong to check user_access() in hook_nodeapi(), hook_user(), and hook_taxonomy(). I think the proper place is in the forms, either by not altering or adding #access properties. Attached is a patch against 6.x-2.3 for those who need a solution now, and a patch against 6.x-2.x-dev for review. Quite a bit has changed in -dev, so I'm not sure if all of the access checks are correct. Please review.
Comment #4
nicholasthompsonThanks cedarm. As you've pointed out, a LOT has changed in dev. I really want to get a tagged release out, so I'm not gonna push to get this into 2.4, but it will DEFINITELY go into 2.5.
Thanks for that patch - I'm interested in that suggestion of putting it in #access rather than in the api hooks. Would that not impact anything which programatically saves data?
Comment #5
cedarm commentedNo problem. I understand about wanting to tag a release.. been there.
As I understand it, if #access is FALSE it's as if that form element isn't even there. As long as validate/submit handlers can deal with that, everything works. As for programmatically saving data, modules like migrate just set node properties and expect the normal save handlers to do their job. Are you concerned that other modules won't honor/check page title permissions themselves in this case?
Programmatically submitting a form may be different.. I'm no expert here. But note that by using #access other modules can form_alter and change it. That's a good thing, right?
Comment #6
damienmckennaThe D6 branch is no longer supported so no new features will be added.