In digging through the eventrepeat code (CVS version) after the recent patch to move event repeat editing into the main form, I noticed that user_access('create repeat events') is no longer called to control access to creation of event repeat nodes. As I read it, all it controls is whether somebody can see the link to the help screen for assistance in building repeats.
I'm guessing that when the hook_menu() changes were done to remove the tab that the access check simply never made it back in. eventrepeat_form_alter() seems to be the appropriate home for an access check call, or perhaps the need to have a repeat specific access check is gone and the permission should go away.
I'll give a similar caveat to another issue I posted recenty: this is from reading the code, not from taking it into a debugger.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | eventrepeat_perm.patch | 1.74 KB | seanbfuller |
Comments
Comment #1
seanbfuller commentedYou're probably right. Good catch. I'll put it on my list.
Comment #2
seanbfuller commentedAdded the check in eventrepeat_form_alter
Note if the event already has a repeat pattern, I give the user the form. This seemed to be the least destructive way to handle things.
Posted here for review / testing before I commit to HEAD.
Comment #3
seanbfuller commentedComment #4
seanbfuller commentedApplied to HEAD.
Comment #5
scott.mclewin commentedSean - if you were looking to me for testing, sorry about missing your window. I didn't look on drupal.org for about a week for updates to issues.
Comment #6
(not verified) commented