Thinking about the d.o use-case, we're going to:

a) want most users not to be able to remove each other's files
b) give certain trusted users the ability to do so in case of cleaning up spam.

So, I guess we need some kind of new permission. :/ Not sure what it should be called. Not sure if we need to change anything about how the settings related to hiding the remove button work or are called, too (other than #1964630: Invert the wording (and behavior) of the setting for the remove button which is a good idea, anyway).

Comments

jthorson’s picture

jthorson CreditAttribution: jthorson commented

The fix for this is probably closely related to the work occuring in #1965078: Allow users to remove their own newly uploaded file, even if the widget is configured to hide the remove button. (i.e. Can use a similar approach.)

dww’s picture

dww
we/he/they
CreditAttribution: dww commented
Issue tags: +project, +drupal.org D7

Yeah, I just wish I knew what to call this permission so that it makes sense in combination with the widget configuration settings.

Also, I know this is going to be an issue for d.o, so tagging accordingly.

tvn’s picture

tvn CreditAttribution: tvn commented

'Administer file attachments'?

dww’s picture

dww
we/he/they
CreditAttribution: dww commented
Assigned: Unassigned » dww

Just hashed this out a bit in IRC with tvn. Highlights:

  • 'Administer file attachments' seems reasonable, although at this point the only impact of that perm is letting you always see the remove button, even if a given file field's widget is configured to hide it.
  • We'll add something to the description of the 'Show "Remove" button" widget setting like: "The 'Remove' button is always visible for users with the 'Administer file attachments' permission."
  • The remove button isn't instantaneous -- you still have to save your node revision, so presumably admins can be careful enough and we don't need to over-engineer a confirm form or "sudo" esque functionality where you go into 'spam-fighting-mode' or something.

So, this all seems quite straight forward. I'll take this since it's a blocker for #1545952: [META] UI for updating an issue in D7.

dww’s picture

dww
we/he/they
CreditAttribution: dww commented
Status: Active » Fixed

Ugh. This was harder than it should have been due to some bugs introduced via other issues:
#1964100-9: Refactor extended_file_field_field_formatter_view() structure
#1964630-6: Invert the wording (and behavior) of the setting for the remove button

But, 3 commits later, we're all set here:
http://drupalcode.org/project/extended_file_field.git/commit/d438f10
http://drupalcode.org/project/extended_file_field.git/commit/9fa89a4
http://drupalcode.org/project/extended_file_field.git/commit/2da829a

Automatically closed -- issue fixed for 2 weeks with no activity.

  • Commit 2da829a on 7.x-1.x, empty-file-2150029 by dww: 
    [#1965082] by dww: Give spam-fighters a way to remove other people's...