Edit Roles option visible on all user edit pages

ac - October 18, 2006 - 03:02
Project:RoleAssign
Version:4.7.x-1.x-dev
Component:User interface
Category:bug report
Priority:normal
Assigned:TBarregren
Status:closed
Description

When editing a users roles, the edit roles checklist is visible not only in the users 'account settings' page, but in all other sections of a users profile. That is to say if the profile.module or any module that extends the users profile to more sections than just 'account settings' is used, then the access roles option is available on all of these sections. It is not a security issue as it only appears when the editing user has the appropriate permissions, but it does clutter the UI.

#1

TBarregren - October 18, 2006 - 10:16
Assigned to:Anonymous» TBarregren
Status:active» fixed

The bug is fixed. Please checkout the latest version from the repository.

#2

ac - October 19, 2006 - 03:08
Status:fixed» active

The new patches to the core broke this fix :( There were slight API changes which is the reason I think.

#3

ac - October 19, 2006 - 03:10

Actually excuse me, this is incorrect. The patch solves the problem for uid->1 but not for other users.

#4

TBarregren - October 19, 2006 - 12:28

I can't replicate the reported behavior. I have tried (i) to patch a 4.7.3 site with the Security Advisory patches 24, 25 och 26, (ii) to upgrade the 4.7.3 site to 4.7.4 and (iii) to create a clean installation of a 4.7.4 site with new database and RoleAssign as the only contributed module. In none of these cases, the behavior was replicated. This is what I did:

  • Enabled RoleAssign and Profile modules.
  • Added a new profile field under a new category (test).
  • Added new roles and made them available for assignment by users with the assign roles permission.
  • Added a new user (webmaster) with following permissions: assign roles, access user profiles and administer users; but not administer access control.
  • Added new users.
  • Logged in as webmaster.
  • Visited the profile page test of each user both before and after making changes to the assigned roles.

If I understand you right, you would, if following above steps, see the Account information fieldset, with only the Assignable roles check boxes, on the test tab. Is that correct? I myself don't see the Assignable roles check boxes on the test tab. That is how it should be. Together with the fact that the change in API seems not to effect my code, this makes me wonder if you possible could have forgot to empty your cache or downloaded the RoleAssign tar ball before the daily update. Could you download it and try again? If that doesn't help, could yo please walk me through, step by step, how to replicate the malfunction on a clean installation.

#5

ac - October 19, 2006 - 15:05
Status:active» fixed

Sorry, I cleared the cache and re downloaded the module and it is all good now. Thanks.

#6

TBarregren - October 19, 2006 - 15:17

No problem. I am glad it worked out.

#7

Anonymous - November 2, 2006 - 15:30
Status:fixed» closed
 
 

Drupal is a registered trademark of Dries Buytaert.