Add 'edit webforms' permission for attached webforms

Subscribing...

I usually dont give access to webform configuration because it is too complex for my clients (even if it seems a bit simpler with v3).

It would be very useful to have such a permission.

Hm, interesting. Webforms have always been a part of the node form up until the 3.x version. Now that they are on a completely separate tab, it would make sense to provide that as a separate permission.

Hmm, I think this might be a bit of a step backwards, since this means that you can no longer use Webform with node access control systems like Organic Groups. I'm not sure if it's possible, but the ideal thing would be to make it so that we still use the node_access() function but add a new permission at the node level for "edit webform".

I'm not sure the proper way to go about doing this either.
But, what if you wrapped the node_access() call within a custom webform_node_access() one?
This would allow the scenario you have described.
As it would return the permissions from whatever Node Access system you are using, then also handle our Webform access permissions.

In concept.

function webform_menu() {
    $items['node/%webform_menu/webform'] = array(
        'title' => 'Webform',
        'access callback' => 'webform_node_access',
        'access arguments' => array('update', 1),
    );
}

function webform_node_access($op, $node, $account = NULL) {
    switch ($op) {
        case "update":
            if (node_access('update', $node) && user_access('edit webforms')) {
                return TRUE;
            }
            break;
    }

    return FALSE;
}

Though the entire request was to make it so that users could have access to edit the webform but not the node itself. The suggested change would only accomplish the reverse, where the node could be edited but the webform could not.

Swing and a miss.
You're right, I miss-understood the request entirely.

Thanks fenstrat, but unfortunately this approach has the same problems I mentioned in #4, which is that Webform would no longer be able to be used with access control systems like Organic Groups. If a user is a "group administrator", they should be able to edit Webform forms but only within their group. If we start using a custom access callback instead of the node_access() function, then access control modules will no longer work with webform and it'd make it so that any user that has "edit webform webforms" (the name is a problem of its own) permissions would be able to edit webforms across the whole site instead of just in their groups.

Ok, new day, new coffee, clear head... let me try to help again.

What are the possibilities of integrating Webform into the Node Access system?
Maybe define our own Realms and Grants to work along side other systems?

Is this beyond the scope of Webform?

I'm not sure this is a feasible problem to solve. What we really want here is a new $op outside of the normal set supported by node.module. Unfortunately the node_access() function is hard-coded to a small set of operations:

function node_access($op, $node, $account = NULL) {
  global $user;

  if (!$node || !in_array($op, array('view', 'update', 'delete', 'create'), TRUE)) {
    // If there was no node to check against, or the $op was not one of the
    // supported ones, we return access denied.

Creating a new access control realm would only make it so that we could control the "edit" operation, it wouldn't make it possible to control the access to just the "webform" tab.

So after all of this analysis, I think the "solution" is to just use hook_menu_alter() if you don't want the edit tab and turn it off for certain roles.

function mymodule_menu_alter($items) {
  $items['node/%node/edit']['access_callback'] = 'mymodule_access_check';
}

function mymodule_access_check($op, $node, $account = NULL) {
  if (empty($account)) {
    $account = $GLOBALS['user'];
  }
  $access = node_access($op, $node, $account);
  $rid = 1; // The role a user must have to edit webform nodes.
  if ($access && $node->type == 'webform' && $op == 'update' && !in_array($rid, $account->roles)) {
    return FALSE;
  }
  return $access;
}

I don't think this can be added as an option in Webform. Additionally, I'm not sure we want to make it an option in Webform anyway.

For those who don't know how to implement fenstrat's code;
http://drupal.org/node/1025724#comment-4037140

Cheers

Thanks guys. Moving to won't fix per the technical difficulties involved. While another module could implement this (or more easily a custom module implementing either of the solutions above), I don't think this is feasible to include in Webform directly because the node access system simply isn't made to handle it. See #4 and #9 for explanations why.

Solution for 7 version -> http://drupal.org/node/1025724#comment-6205060