Hi,
First thanks for this module, it's a really cool functionnality !
I just need it to be compatible with the Vocabulary Permissions Per Role (vppr) module :

I assigned some roles to administer some vocabularies ( I don't want to allow them to rule all ), but as they don't have the "administer taxonomy" permission, they can't publish or unpublish terms.

I tried to alter the module to change permissions :
In termstatus_form_taxonomy_form_term_alter() and termstatus_form_taxonomy_form_vocabulary_alter(), I replaced user_access('administer taxonomy') by the vppr permissions user_access('administer '.$vocabulary->machine_name.' vocabulary terms').

It works for manual edit : I mean that if I edit the taxonomy term, I can see the status checkbox, check it, and the new status is saved.
But my problem is that in my view, the VBO actions "publish" ans "unpublish" don't care about these new permissions : It only uses "administer taxonomy" permission.

I've seen that there's an access permission defined in termstatus_entity_property_info_alter(&$entity_info) function, but if it's the right value to change to make VBO work as designed, I will need to replace 'access permission' => 'administer taxonomy', by several access permissions, as my users can administer several vocabularies ; or by the current vocabulary at least, depending on when the funciton is loaded, and what is passed through the $entity_info argument. But I don't how it works at all, and I can't print $entity_info anywhere. It never shows up. Maybe because VBO it using ajax ?

So, I'm stuck here.
Thanks for your help.

CommentFileSizeAuthor
#5 custom.module.txt2.1 KBseren10pity13

Comments

znerol’s picture

znerol commented

Ok, thanks for the report. Concerning the VBO stuff, I think this is an issue with the entity module. Let me explain:

First, our implementation of hook_entity_property_info_alter seems to be wrong. As per the hook_entity_property_info documentation only the keys access callback and setter permission are used to determine if a user has edit-access to a taxonomy term or taxonomy vocabulary. In my implementation there is access permission which I suppose will simply be ignored by entity API / VBO. Because the implementation for taxonomy terms shipping with the entity API does not have any access-keys, I'm pretty sure that term status does not need to enforce access-checks to the status-property neither.

Second, the entity API adds access-checks for core entities in _entity_info_add_metadata which is called from its implementation of the core hook hook_entity_info_alter. The access callback for taxonomy terms is forced to entity_metadata_taxonomy_access. In a little experiment I was able to make vppr work together with VBO by injecting the following additional access-check:

  if (isset($entity) && $op == 'update' && user_access('administer ' . $entity->vocabulary_machine_name . ' vocabulary terms', $account)) {
    return TRUE;
  }

So probably you want to check with the maintainers of vppr or entity API on how this check could be injected without having to patch entity API.

HTH

seren10pity13’s picture

seren10pity13 commented

Thanks for your quick answer, the code you proposed worked like a charm !

To avoid patching Entity.module, I tried to use a Custom module with a hook_entity_info_alter(), to replace Entity's access callback function for taxonomies by another one : 

<?php
function custom_entity_info_alter(&$entity_info) {
  if (module_exists('taxonomy')) {
    /* Replace entity's taxonomy access callback by ours 
     * -->see  entity_entity_info_alter() and _entity_info_add_metadata() in entity.module
     * $entity_info['taxonomy_term']['access callback'] = 'entity_metadata_taxonomy_access';
     * $entity_info['taxonomy_vocabulary']['access callback'] = 'entity_metadata_taxonomy_access';
     */
    $entity_info['taxonomy_term']['access callback'] = '_custom_entity_metadata_taxonomy_access';
    $entity_info['taxonomy_vocabulary']['access callback'] = '_custom_entity_metadata_taxonomy_access';
  }
}
/*
 * Access callback for the taxonomy entities. 
 * Duplicate of entity_metadata_taxonomy_access() from entity/modules/callbacks.inc, but changes conditions for update op.
 */
function _custom_entity_metadata_taxonomy_access($op, $entity = NULL, $account = NULL, $entity_type) {
  if ($entity_type == 'taxonomy_vocabulary') {
    return user_access('administer ' . $entity->vocabulary_machine_name . ' vocabulary terms', $account);
  }
  // if (isset($entity) && $op == 'update' && !isset($account) && taxonomy_term_edit_access($entity)) {
  if (isset($entity) && $op == 'update' && user_access('administer ' . $entity->vocabulary_machine_name . ' vocabulary terms', $account)) {
    return TRUE;
  }
  if (user_access('administer taxonomy', $account) || user_access('access content', $account) && $op == 'view') {
    return TRUE;
  }
  return FALSE;
}
?>

I think that it should work, but according to my tests, it seems that my custom_entity_info_alter() function is executing before entity_entity_info_alter(), even if my custom module has a weight of 4 in the system table, when entity's weight is 0...
Stuck again.

I'm gonna move this issue to vppr issue queue because, as it set new access permissions for taxonomies, I think it's up to them to make it compatible with Entity and VBO that are widely used.

Thank you very much for your investigations on this. It helped me a lot.

Seren10pity

znerol’s picture

znerol commented

Entity API alters the execution order of hook_entity_info_alter by implementing hook_module_implements_alter. Therefore you need to do the same and ensure that your alter-hook runs after the one of Entity API...

seren10pity13’s picture

seren10pity13 commented

Yes ! You led me in the right direction, and I managed to make it work. I removed the modifications in Entity, and used only the custom module, with the hooks you suggested to me.

Thank you very much.

seren10pity13’s picture

seren10pity13 commented
Version: 7.x-1.0-alpha1 » 7.x-1.x-dev
Status: Active » Closed (fixed)
StatusFileSize
new custom.module.txt2.1 KB