I've been spending some time digging through code and issues and, as far as I can tell, this isn't possible so I'm filing it as a feature request. If I've missed something where you can already do it, I apologize.

I have a use case where I want any authenticated user to be able to set a particular flag on his/her own nodes. So I set the flag to "Users may only flag content they own". This works but there's a problem. No one, not even UID 1, is able to (un)flag content that they don't own. That means I totally have to trust the user to set the flag right with no way short of going in the database of changing it.

Ideally, I'd like to have a role that can be set on a flag where members of that role are allowed to alter other peoples' flags. If that's not possible, could it at least be done so UID1 can edit any flag?

In my searching, I found #755840: Administrator Role to Change other User's Flags or Flag on behalf another user which is close to this issue. It's not quite a duplicate, though, because I'm dealing with global flags and that issue wants to be able to do it on individual flags.

Thanks,

Michelle

Comments

mooffie’s picture

So I set the flag to "Users may only flag content they own". This works but there's a problem. No one, not even UID 1, is able to (un)flag content that they don't own.

That's right. Flag currently doesn't give user #1 preferential treatment.

I'd like to have a role that can be set on a flag where members of that role are allowed to alter other peoples' flags. If that's not possible, could it at least be done so UID1 can edit any flag?
[...]
I'm dealing with global flags

A quick answer:

You can implement hook_flag_accees() in your module to tweak Flag's access scheme. For example, to give user #1 permission to use a flag unconditionally, do:


/**
 * Implementation of hook_flag_access().
 */
function MYMODULE_flag_access($flag, $content_id, $action, $account) {
  if ($flag->name == 'needs_work' && $account->uid == 1) {
    return TRUE;
  }
}

/**
 * Implementation of hook_flag_access_multiple().
 *
 * You must also implement this hook. This hook, for performance reasons, is called for a bunch of items.
 */
function MYMODULE_flag_access_multiple($flag, $content_ids, $account) {
  $access = array();

  if ($flag->name == 'needs_work' && $account->uid == 1) {
    foreach ($content_ids as $id => $action) {
      $access[$id] = TRUE;
    }
  }

  return $access;
}

However, your module must come after Flag in the modules' chain (i.e., have greater weight or come later alphabetically) or else Flag's own permission scheme would override yours. Indeed, I see that others have already noticed this flaw in Flag:

#720672: Make $flag->access (and _multiple) act in a consistent manner

We should certainly improve/fix matters before Flag 2.0 is out. I'll be investigating this.

Add additional setting per flag for roles that can change other peoples' flags
[...]
I'm filing it as a feature request

(An alternative is to have a "super flagger" role: a user carrying it would bypass access checks. But this solution isn't granular enough. So yours is better.)

This sounds to me like a very valid feature request. On the other hand, we want to keep Flag small and simple, and that feature can be easily implemented by a contrib module (via hook_flag_access()).

========

In my searching, I found #755840: Administrator Role to Change other User's Flags or Flag on behalf another user It's not quite a duplicate, though, because I'm dealing with global flags

Indeed, #755840 is irrelevant for you.

michelle’s picture

Oh, that is awesome! A quick and thorough response. I should take lessons. :)

For my purposes, knowing those hooks is good enough. I know how to code and how to set the weight of my site module. I probably won't be able to implement it until the kids go to bed in 12ish hours and can come back then if I run into any problems.

As far as I'm concerned this is fixed. Up to you if you want to leave this as an active feature request for people who can't code. My basic thought for the UI was to add another column to "Roles that may use this flag" for "Flag other user's content" and "Unflag other user's content". So it wouldn't be complex from a UI standpoint. I don't know about under the hood. Alternately, you could merge "Flag access by content authorship" into those checkboxes and have a nice set of per-role per-flag permissions without making the UI too complex. Again, I don't know what kind of mess that would create in code.

Thanks again!

Michelle

quicksketch’s picture

Status: Active » Closed (fixed)