Currently, we display all VBO operations regardless of whether a user's permissions actually allow all of them. VBO ships with the Actions Permissions module to allow for more granular control of this.

I intend to enable this module and assign appropriate permissions to our roles.

These should be:

aegir administrator
execute Platform: Delete (hosting_platform_op_delete)
execute Platform: Lock (hosting_platform_op_lock)
execute Platform: Unlock (hosting_platform_op_unlock)
execute Platform: Verify (hosting_platform_op_verify)
execute Site: Backup (hosting_site_op_backup)
execute Site: Delete (hosting_site_op_delete)
execute Site: Disable (hosting_site_op_disable)
execute Site: Enable (hosting_site_op_enable)
execute Site: Reset password (hosting_site_op_login_reset)
execute Site: Verify (hosting_site_op_verify)

aegir client
execute Site: Backup (hosting_site_op_backup)
execute Site: Delete (hosting_site_op_delete)
execute Site: Disable (hosting_site_op_disable)
execute Site: Enable (hosting_site_op_enable)
execute Site: Reset password (hosting_site_op_login_reset)
execute Site: Verify (hosting_site_op_verify)

aegir platform manager
execute Platform: Delete (hosting_platform_op_delete)
execute Platform: Lock (hosting_platform_op_lock)
execute Platform: Unlock (hosting_platform_op_unlock)
execute Platform: Verify (hosting_platform_op_verify)
execute Site: Delete (hosting_site_op_delete)
execute Site: Disable (hosting_site_op_disable)
execute Site: Enable (hosting_site_op_enable)
execute Site: Verify (hosting_site_op_verify)

Comments

ergonlogic’s picture

Assigned: ergonlogic » Unassigned
Status: Active » Needs review

Fixed in 4fe1c6b and a0799036. I'm leaving this as 'need review' for now, to get feedback from other maintainers.

anarcat’s picture

Where is commit 4fe1c6b? nevermind, it's in hostmaster.

anarcat’s picture

Status: Needs review » Needs work

there are two problems here:

1. module_enable(array('actions_permissions')) is not performed in the install profile
2. i don't understand why we enable install_profile_api - comment says it's to load includes, but module_load_include() is in core...

ergonlogic’s picture

Status: Needs work » Fixed

Enabling install_profile_api is for the install_add_permissions().

Fixed in b11efa60c (on hostmaster).

anarcat’s picture

you forgot the comment bit, fixed and pushed 7979b53

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

  • Commit 7979b53 on 6.x-2.x, 7.x-3.x, dev-ssl-ip-allocation-refactor, dev-sni, dev-helmo-3.x by anarcat:
    clarify why we need install_profile_api still, see #2031765
    
  • Commit a079903 on 6.x-2.x, 7.x-3.x, dev-ssl-ip-allocation-refactor, dev-sni, dev-helmo-3.x by ergonlogic:
    Issue #2031765: Clean up VBO operations with Action Permissions.
    

  • Commit 7979b53 on 6.x-2.x, 7.x-3.x, dev-ssl-ip-allocation-refactor, dev-sni, dev-helmo-3.x by anarcat:
    clarify why we need install_profile_api still, see #2031765
    
  • Commit a079903 on 6.x-2.x, 7.x-3.x, dev-ssl-ip-allocation-refactor, dev-sni, dev-helmo-3.x by ergonlogic:
    Issue #2031765: Clean up VBO operations with Action Permissions.