Project view permissions incorrectly override all other access controls [#78704]

When the global "access projects" permission is present, the project module overrides all access controls unconditionally rather than deferring to node_access permissons. Thus, if anonymous users have "access projects", but OG is then used to restrict certain projects to certain private groups, even private projects are visible to anonymous users.

This patch modifies the project module so that:

"access own projects" unconditionally forces view access for projects belonging to owners who have the designated role.
If "access projects" is not granted, than all users with the given role will be denied access.
Otherwise, standard node_access privileges apply to all project nodes.

This is my first patch. I'm new here. But, I have tested this patch thorougly several times and it is pretty simple. It follows the guidelines outlined for hook_access() overrides.

Comment	File	Size	Author
#3	modules_project_project_inc_03Sep06.patch	725 bytes	garywiz
	modules_project_project_inc_15Aug06.patch	707 bytes	garywiz

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

dww

we/he/they

CreditAttribution: dww commented 17 August 2006 at 12:25

Status:

Needs review

» Needs work

minor gripe: your patch uses tabs, not spaces, which violates the drupal coding guidelines: http://drupal.org/node/318, in particular http://drupal.org/node/539. normally, i'd just fix it myself before applying the patch, but since it's your first patch, i wanted to give you some guidance for the future. ;)

also, there's a bug: $node-uid should be $node->uid.

otherwise, this looks like a good fix. i haven't tested it myself, but i will before i commit. i don't see anything else wrong, and it'd be good for project access to work nicely with other things like OG.

thanks,
-derek

Comment #2

garywiz CreditAttribution: garywiz commented 17 August 2006 at 22:22

The tabs instead of spaces... that one I'll remember to take care of. But, eeeks! The $user-uid typo! Honest, this very patch was applied and tested. However, I did not test the "user owned" circumstance. I wonder what php does with that expression?

I'll upload a correction tonight, and thanks for the newbie tips.

Comment #3

garywiz CreditAttribution: garywiz commented 3 September 2006 at 02:05

Category:	bug	» feature
Status:	Needs work	» Needs review

File	Size
modules_project_project_inc_03Sep06.patch	725 bytes

Here is an updated patch with the uid syntax error fixed and tabs replaced with spaces. I tested this against my dev build and it works.

Comment #4

dww

we/he/they

CreditAttribution: dww commented 18 November 2006 at 02:30

Category:	feature	» bug
Status:	Needs review	» Fixed

tested heaviliy (using simple_access.module) on a local site. works great. fixed the coding style a little bit and committed to DRUPAL-4-7 and DRUPAL-4-7--2 branches.

thanks!
-derek

p.s. it was a bug. "please make this module work right" doesn't count as a feature request IMHO. ;)