redhen_relation_connections_page() calls redhen_relation_access() with op "update" and "delete", causing redhen_relation_access() to check the permission "update redhen contact connections" or "delete redhen contact connections" etc.

Neither of these permissions exist. You can change "update" to "edit" for the "edit" link and it appears, but you still need "Edit relations" to make it possible to perform the action. This is different to the behaviour of "add", which does not require "Create Relations".

Proposed solution:

Correct the "update" permission and add "delete redhen contact connections" and "delete redhen org connections" continue to require "Edit Relations" and "Delete Relations" as well. To be consistent, we would need to check for "Create Relations" when adding.

The alternative is to have custom delete and edit methods to keep us separate from the "Relations" permissions. I'm slightly in two minds.

Happy to make a patch for the favoured method...

Comments

I think the simplest solution is your first suggestion, to change update to edit and add a delete permission. Patch welcome or we'll take care of it, let us know. Thanks!

Status:Active» Fixed

Fixed in bb3631b98e3ba37bf22f854c32a9a813fcafe663.

Status:Fixed» Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.