Expand the Nodewords permissions to cover more granularity

I totally agree... I'm looking for this option myself.

This issue is plaguing me too, i hope a solution will be found soon.

subscribe

This may not be a complete solution, but it resolved my immediate problem of having meta tag fields showing up for users who should not see them.

I added a permission for editing meta tags in nodewords.module:

<?php
function nodewords_perm() {
  return array('administer meta tags', 'edit meta tags');
}
?>

Then I added a user access check to the hook_form_alter that inserts the meta tag fields in nodewords_ui.module:

<?php
function nodewords_ui_form_alter(&$form, $form_state, $form_id) {
  $bool = (
    user_access('edit meta tags') &&
    isset($form['type']) &&
    isset($form['#node']) &&
    $form_id == $form['type']['#value'] . '_node_form'
  );
?>

I'm using 1.12-beta9 in case that is different from the dev version.

Thx Gilgabar. Patch working great on Nodewords 6.x-1.12-beta9. I think this is an essential feature.

Subscribe

Attached are patches implementing #9 (one for nodewords.module, and one for nodewords_ui.module; apply both).

Applying both patches in #12 and configuring the permission resolved the issue for me.

Adding this to the v6.x-1.12 issue list.

Yeah this is definitely needed. The fact that anyone that can add/edit nodes or edit their own profile can also edit meta tags on the page is a bad, bad, bad thing.

Revised patch that adds a 'edit meta tags' permission and is used to control access to if users can view meta tag fieldset on node or account edit forms.

Looks great - adds a much-needed improvement and cleans up the existing code in the process, good stuff!

BANG! Committed to CVS.
http://drupal.org/cvs?commit=444264

Feels good to have this long-standing issue finally fixed.

I added a follow-up issue to expand upon this to control it per content type: #957860: Per-content type permission to control access to Nodewords fields for each content type

Does this not get checked for on the node edit form? I still see them as a user without this permission.

Perhaps the "administer meta tags" permissions is meant just for the global settings?

Sorry, I get it. Dealing with anonymous users creating nodes, so this is extra poignant :)

Needs to be re-rolled against the latest 6.x-1.x codebase.

I re-rolled Dave Reid's patch from #16 against the latest 6.x-1.x codebase and ensured all hook_form_alter() and hook_form_FORM_ID_alter() changes are appropriately secured.

Re-rolled against 6.x-1.x, again.

+        if (user_access('administer meta tags') || user_access('edit meta tags')) {
+          $tags = nodewords_load_tags(NODEWORDS_TYPE_USER, $account->uid);
+            $form['nodewords'] = nodewords_form(

Indentation is slightly off, I think.

Not about to claim I know what all this patch does.. its a biggie!

#27: I believe that is an illusion of the diff. The whitespace is different because an additional if () has been added.

Updated. The logic for identifying if the user profile meta tags should be edited has been adjusted slightly, per the following comment:

    // Only show the meta tags fields if:
    // * This is the main 'account' profile edit tab,
    // * The user meta tags are enabled.
    // * The user has the main 'administer meta tags' permission
    //   OR the user has the 'edit meta tags' permission and is editing their
    //     own profile.

The question is - is this ok? Should it just be expanded to have a separate permission for each type meta tags, i.e. one for nodes, one for terms & one for users? Should the users tags functionality be changed to have one permission or option for deciding if a user can edit their own tags and something else to decide if a "manager"-style user can modify someone else's tags? Or should we instead just rely on the core 'administer users' permission to decide some of this? Answers on a postcard - what does everyone think?

I'm starting to think that the permissions need to follow Drupal core a little more closely:

1. administer meta tags - control all Nodewords configuration and meta tags.
2. administer content types (from Drupal) - change the default meta tags for each content type (see #945676: Allow defaults to be defined per content type and #1279864: Restructure tagging to be a series of hierarchies). I figured that if you're giving a user the permission to edit the content type that they should just have all permissions?
3. edit any meta tags for [content type] nodes - change meta tags for any nodes of a given content type.
4. edit own meta tags for [content type] nodes - change meta tags for nodes the user created of a given content type.
5. administer taxonomy (from Drupal) - change the default meta tags for each vocabulary.
6. edit meta tags for [vocabulary] terms - change meta tags for terms in a given vocabulary.
7. edit meta tags for all users - change meta tags for any user.
8. edit own user meta tags - change a user's own meta tags.

Right now we only have 'administer meta tags', so there's a long way to go.

Should we go that far with it?

Thoughts?

Not going to add this to the next release.

Bumping to v2, I just feel this will require too much API changes to be worth its while right now.

Marking all v2 issues as postponed while v1 is finished off.

Unfortunately this module is no longer supported, so I'm closing this issue.