Blogs are "created" for users who don't have permissions [#185893]

If you enable blog module, even if you only have blogs set up for certain roles, all user's still get assigned a blog.

drupal.org/blog/n returns a page of empty results "username's blog".
pathauto creates blog/n and or blog/n/feed aliases for all new users
you can assign a blog post to a different user without blog permissions (assuming you have permissions to do so) and it'll appear in their blog.

This means a lot of useless path aliases created. And also a lot of useless empty (potential) urls.
Maybe some of the ideas in this could be applied: http://drupal.org/node/120255

A possible solution would be to set some kind of "has blog" flag when the first 'blog' node is posted by a user, which would be unset if all blog nodes by that user were deleted - which could then allow other blog related modules to hook into it.

Comment	File	Size	Author
#8	blog_edit_own_blog_0.patch	624 bytes	catch
#8
#7	blog_edit_own_blog.patch	640 bytes	RobLoach
#7

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

RobLoach

he/him

CreditAttribution: RobLoach commented 27 October 2007 at 13:45

Status:

Active

» Postponed (maintainer needs more info)

When users have the "edit own blog" permission, they are given their own blog. If their blog is empty, it doesn't mean they don't have one, it just means that their blog is empty.

Also, if you deny them from seeing their own blog when it's empty, they won't be able to create their first blog entry if you've disabled the menu item Create Content -> Blog Entry.

Comment #2

catch

he/him

English

CreditAttribution: catch commented 28 October 2007 at 16:57

Status:

Postponed (maintainer needs more info)

» Active

When users don't have "edit own blog" permission, they also have an empty blog (which gets aliases created by pathauto etc.) - this is what I've been experiencing anyway.

Comment #3

markus_petrux CreditAttribution: markus_petrux commented 29 October 2007 at 14:14

I'm working on a site with big user base, thousands, and all of them will be potential bloggers when the service is ready, but it is probably that not all will use their blog, so we have to find a solution here. Planned Drupal version for this project is 5.x.

One possible approach that I'm looking at right now is to set isolate the "edit own blog" permission into a separate role, and then generate a procedure for users where they will have the option to "create" their own blog. That particular role will be assigned automatically when they submit their request. We'll have to find a way to invoke pathauto so the corresponding aliases are created as well.

We need to provide such a procedure for users because there will be other options that they will be able to setup for their accounts. Nothing that Drupal does by itself, but something that can be easilly done with a custom module.

Well, maybe this can provide some ideas to this subject. Since the problem here might need different solutions, not sure if this is something that can be solved easilly by the blog module and/or Drupal core itself.

Cheers

Comment #4

catch

he/him

English

CreditAttribution: catch commented 29 October 2007 at 14:19

Markus, the blog activation procedure - "creating" their own blog, is exactly the sort of thing I have in mind. Might even be a use for actions I guess. We have ~3000 users on our site, about 20 bloggers - so that's 5960 pointless url aliases in the system for no reason.

Comment #5

markus_petrux CreditAttribution: markus_petrux commented 29 October 2007 at 14:39

Yes, maybe the actions module could be a possible approach. The idea I'm thinking as a possible generic solution is that that the "has blog" flag could be the "edit own blog" permission itself, but then you have to find a way to programmatically assign this permission (be it done with through actions or custom coding) or even to deassign, maybe if you need to "deny/revoke/remove" the blog of particular users that do not conform on TOS, etc.

Actually, the site has more that 200,000 registered users (more than 1,000 users online / 5 min. interval, around 2 million page visits a day), so I have to find more ways to optimize the "aliases" problem.

hmm... anyway, what I'm trying to mean is that I can't an easy way to deal with the "user has blog" dilema in core. When such a need arises, there are probably more things to take into account, to solve... and maybe the fact that the "edit own blog" permission can be used as a flag is enough in terms of core functionallity. :-/

Comment #6

catch

he/him

English

CreditAttribution: catch commented 29 October 2007 at 14:50

One answer might be taking the blog module out of core and make it dependent on views. Replace it with a simple node type declaration, a hooked-in view and some breadcrumb customisation. The view hook would solve the aliases issue, node types are easy.

Either that or make it into a drupal "entity" that contrib modules could more easily hook into (panels etc.).

Comment #7

RobLoach

he/him

CreditAttribution: RobLoach commented 29 October 2007 at 15:09

Status:

Active

» Needs review

File	Size
blog_edit_own_blog.patch	640 bytes

The access callback and arguments should fix this. I really love this new menu system....

Comment #8

catch

he/him

English

CreditAttribution: catch commented 29 October 2007 at 15:35

Status:

Needs review

» Reviewed & tested by the community

File	Size
blog_edit_own_blog_0.patch	624 bytes

This attached patch uses unix line breaks instead of windows (got a "trailing CRs" message when I applied it).

I reviewed the patch - when users have "edit own blog" then the behaviour is the same as now (empty blog (with create blog post link if it's your own blog). When that permission isn't there, you get access denied for blog/[uid] paths for those users.

I doubt this will fix the pathauto issue but that may be impossible to do in core as it stands, so setting what is quite a trivial fix to RTBC. Very nice!