I have a flag with Flag access by content authorship set to Users may only flag comments by others. When I add a this field to a view using (flag) Flags: Flag link, it always displays, even when the user is viewing their own content. When the user clicks on the flag link, it correctly says that they can't flag it, but it shouldn't show up at all.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

kielni’s picture

Here's a patch that checks $flag->access($content_id) before outputting the flag link

kielni’s picture

Status: Active » Needs review

set to needs review

joachim’s picture

Version: 7.x-2.0 » 7.x-3.x-dev
Status: Needs review » Postponed (maintainer needs more info)

Access is already checked in:

    $this->flag_applies = $ids ? $flag->access_multiple($ids) : array();

Is that access check failing, and how?

kielni’s picture

Yes, it's failing because the calls to check the access are different.

pre_render calls $flag->access_multiple($ids)

and I added this to render: $flag->access($content_id)

access has this additional code that's not in access_multiple

$access_array = module_invoke_all('flag_access', $this, $content_id, $action, $account);

which calls flag_flag_access. In my case, this denies permission for a user to flag their own comment. That's why it looked like it wasn't checking permissions; I guess a better patch would be to make the flag_access call from access_multiple also?

joachim’s picture

$flag->access_multiple() invokes hook_flag_access_multiple(). At least it does on 3.x.

If you want this on 2.x, you can find the issue and backport it, though at this point it would be more expedient to help get us to a 3.0 release :)