Hello,
It seems that users need the "Edit media" permission in order to use the media popup. Otherwise the popup opens but is empty (please see screenshot).
The problem is that "Edit media" permission seems to also enable users to edit other users' media.
-----
So my questions are:
- Am I missing something regarding the media and media-gallery set of permissions
- If the answer is no, could you please give your opinion/advise on the following workaround :
1) in a costum module, change the menu item 'media-gallery/detail/%node/%media/edit' so that it uses another access callback function
<?php
function mymodule_menu_alter(&$items) {
$items['media-gallery/detail/%node/%media/edit'] = array(
'title' => 'Edit',
'page callback' => 'media_gallery_media_page_edit',
'page arguments' => array(2, 3),
'access callback' => 'media_gallery_media_access', // change here
'access arguments' => array('edit', 2), // change here
'weight' => 0,
'type' => MENU_LOCAL_TASK,
'context' => MENU_CONTEXT_PAGE | MENU_CONTEXT_INLINE,
'file' => 'media_gallery.pages.inc',
'theme callback' => '_node_custom_theme',
);
}
?>
2) Give access to media if user has "Edit media" permission AND if user is author of gallery:
<?php
function media_gallery_media_access($op, $node) {
global $user;
return media_access($op) && $user == $node->uid;
}
?>
Thanks in advance.
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | deny_edit_media_permission_to_other_users-1110462.patch | 1.38 KB | aftab0000 |
| empty media popup.JPG | 29.65 KB | rombapa |
Comments
Comment #1
rombapa commentedComment #2
rombapa commentedAnyone?
Comment #3
aftab0000 commentedI was having the same problem and find a solution almost like rombapa's workaround. I just give the edit media permission to those user who can edit the gallery and who provided media item is attached to the gallery. Which is same as remove media permission. Patch is attached.
Thanks,
Aftab
Comment #4
tobbetobbe commentedHi! I tried the patch but users can still edit other users media. Do you have it working now, aftab0000?
Ideally, I would like my users to not be able to even add others users media to their gallery. But if that is not possible, I would not want them to be able to edit other users media - change image name, etc.
Comment #5
moloc commentedThere is no media permission by user, if i see it correct.
The workaround in #0 and #3 will not work, because users who know the media_gallery and media module, can still change other users media, if they go to media/%/edit and have the edit media permission. Therefore fixing this in media_gallery is the wrong place.
This is somehow a related/duplicate issue of #1061076: Gallery and Media per User. There you find more information about the issue in comment 4.
Comment #6
amittarkar commentedany updates for 7.x-2.x-dev
Comment #7
moloc commentedIn 7.x-2.x it is possible to set edit / delete permissions by the file_entity module.
I tested it and fixed an issue (see related issues).
For 7.x-1.x we cannot do anything, as this feature is only supported in the newer file_entity module version.
If you find any new issues regarding permissions, create a new ticket.