Administrative permissions should be specific, not open to all administrators [#1289768]

On a site with multiple roles, this module grants any user who has permission to access any administrative page the power to change the module's configuration. ("Content types available in archive").

This is Not Good, as forum aides (for example) can muck up the system.

Just a few lines to add "administer archive settings:"

/**
 * Implementation of hook_menu().
 */
function archive_menu() {
  $items = array();
  $items['archive'] = array(
    'title'            => 'Archives',
    'access arguments' => array('access content'),
    'page callback'    => 'archive_page',
    'file'             => 'archive.pages.inc',
    'type'             => MENU_SUGGESTED_ITEM
  );
  $items['admin/settings/archive'] = array(
    'title'            => 'Archives',
    'description'      => 'Select the content types listed in the archives.',
    'access arguments' => array('administer archive settings'), // ADD THIS LINE
    'page callback'    => 'drupal_get_form',
    'page arguments'   => array('archive_admin_settings'),
    'file'             => 'archive.admin.inc',
    'type'             => MENU_NORMAL_ITEM
  );

  return $items;
}

/**
 * Implementation of hook_perm // ADD THIS FUNCTION
 */
 function archive_perm() {
  return array('administer archive settings');
}

Comments

Comment #1

manos_ws CreditAttribution: manos_ws commented 17 May 2012 at 16:13

For D7 change the line 44
from

    'access arguments' => array('access administration pages'),

    'access arguments' => array('administer archive'),

and add the function

/**
 * Implements hook_permission().
 */
function archive_permission() {
  return array(
    'administer archive' => array(
      'title' => t('Administer Archive'),
    ),
  );
}