The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Users with "can lock" (and not adminster locks) see the "Locked documents" tab on other users' profile pages. No locks are displayed unless user has administer locks permission, but I don't think the locks tab should be displayed on other user's profiles unless user viewing has adminster locks permission.
| Comment | File | Size | Author |
|---|---|---|---|
| #1 | menu_access_handler-1280830-1.patch | 1.88 KB | jaydub |
Comments
Comment #1
jaydub commentedI would agree that another user shouldn't be able to view the locked documents tab of another user unless they have the administer locks permission. Furthermore the help text for this path (user/%/content_lock) has hardcoded the word 'you' in the string 'Below is a list of all documents locked by you...'
The attached patch adds a menu access callback to only allow menu access if user has the admin permission or the logged in user has the check out documents permission AND is viewing their own locked documents tab page (user/%/content_lock).
Comment #2
bulldozer2003Sorry I just tested this patch today. After patching, the locked documents tab still appears when users with "check out documents" are viewing another user, except now they can see the list of locked documents! The release lock option is just not available.
Comment #3
jaydub commentedDid you happen to clear the cache by chance as the menu would probably have to be rebuilt...I'll try to take another look.
Comment #4
bulldozer2003You might be right, but rather than "clear the cache" I just checked again right now 6 days later. I assume the cache cleared itself in the interim. Thanks!
Comment #5
pandaski commentedComment #6
astonvictor commentedI'm closing it because the issue was created a long time ago without any further steps.
if you still need it then raise a new one.
thanks