The voting results (the graphical version) are always shown to any user that can view the vote. Even though the permission for "View Voting Results" is not checked, it is still shown.

CommentFileSizeAuthor
#19 1347134-19.patch430 bytesamateescu
#16 drupal-n1347134-15-d7.patch532 bytesDamienMcKenna
#10 1347134-view_voting_results_permission_name-10.patch561 bytesc31ck
#8 1347134-view_voting_results_permission_name-8.patch535 bytesc31ck
#7 1347134-view_voting_results_permission_name-7.patch498 bytesc31ck
#4 1347134-view_voting_results_permission_name-4.patch432 bytesamateescu
#1 updatedpermissions7-1347134-1.patch552 bytesShyamala
#1 updatedpermissions8-1347134-1.patch552 bytesShyamala
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Shyamala’s picture

Shyamala CreditAttribution: Shyamala commented
Version: 7.9 » 8.x-dev
Status: Active » Needs review
FileSize
updatedpermissions8-1347134-1.patch552 bytes
updatedpermissions7-1347134-1.patch552 bytes

The Bug replicated. Even when the the permission for "View Voting Results" is not checked the Results Tab are visible. The perm for "View Voting Results" not passed to _poll_menu_access.

Added patch for Drupal 7 & Drupal 8

David4514’s picture

David4514 CreditAttribution: David4514 commented

Thanks... That solves part of the problem. Now, when a user clicks on the results link or tab, they get access denied. It would be nice if the links/tabs themselves disappeared.

The problem is there is no need for the user to do that. After submitting a "vote" they are shown the voting results in a graphical format (horizontal bar graph). This graph is shown whether or not the user is allowed to see the results or not. Is there some way that this graph can be suppressed if the user in not authorized to see results?

[Edit: I think I understand my disconnect. What you mean by the permission "View voting results" is that this allows you to see the list of people (or IP addresses for anonymous) that have voted, how they voted, and when. The way I had interpreted "View voting results" was that would allow someone to see the summation of the voting results which you represent with your horizontal bar graphs. I had expected that anyone without "View voting results" permission should not be able to see this summation. I would still like to see this as a separate choice. I had really just accidently tripped over another bug.]

amateescu’s picture

amateescu CreditAttribution: amateescu commented
Status: Needs review » Needs work
Issue tags: +Needs tests

I think the patch(es) from #2 are valid for the scope of this issue, they are fixing the actual bug. As for #3, that should be a feature request for D8 because I'm pretty sure we can't change the UX at this stage in D7.

Setting to NW because we could use a test here..

amateescu’s picture

amateescu CreditAttribution: amateescu commented
Title: View Voting Results permission is ignored. » 'View voting results' permission is misleading
Status: Needs work » Needs review
Issue tags: -Needs tests +String freeze, +Needs backport to D7
FileSize
1347134-view_voting_results_permission_name-4.patch432 bytes

After taking another look at this issue and a talk with @webchik on IRC, the real problem is the human readable name of the permission, which is totally misleading:

function poll_permission() {
   ...
    'inspect all votes' => array(
      'title' => t('View voting results'),
    ),
  ...
}

We don't have the functionality to hide/view voting results, as the name would suggest (there's a long-standing feature request for it in #85840: Hide poll results). My proposal is to just change the human readable name of this permission.

How about 'View detailed voting results'?

David4514’s picture

David4514 CreditAttribution: David4514 commented

That would be a big help! While I'll still hope for a future feature that can hide the graphical results, a better description of what the permission means could save someone else from spending hours trying to figure this out. Thanks!!!!

xjm’s picture

xjm
she/her
Primary language English
CreditAttribution: xjm commented

I might suggest that we additionally add a permission description explaining just what the detailed results are?

c31ck’s picture

c31ck CreditAttribution: c31ck commented
FileSize
1347134-view_voting_results_permission_name-7.patch498 bytes

Adding a permission description would indeed help to clarify this even more. How about 'View detailed info, such as username and time, about all recorded votes.'?

c31ck’s picture

c31ck CreditAttribution: c31ck commented
FileSize
1347134-view_voting_results_permission_name-8.patch535 bytes

Uploaded wrong patch in previous comment.

xjm’s picture

xjm
she/her
Primary language English
CreditAttribution: xjm commented

Well, in the interface text, we should use the full word "information." I'd reword as:

View detailed information about all recorded votes (for example, username, submission time, etc.).

Any other proposals? :)

Edited.

c31ck’s picture

c31ck CreditAttribution: c31ck commented
FileSize
1347134-view_voting_results_permission_name-10.patch561 bytes

Yes, that's better, changed patch accordingly.

yoroy’s picture

yoroy CreditAttribution: yoroy commented

Can we load load some of those specifics given in the description, add it to the label and not need the description anymore?

"View detailed vote information" or
"View detailed information for all votes" as variation on what xjm suggests, 'recorded' is not needed I think.
"View details for all votes" <- I think I like this one best

amateescu’s picture

amateescu CreditAttribution: amateescu commented
Issue tags: +Usability

Tagging for the Usability team.

yoroy’s picture

yoroy CreditAttribution: yoroy commented
Status: Needs review » Needs work

At the very least, we shouldn't need parentheses and 'etc.' in a description. Any thoughts on the suggestions in #11?

amateescu’s picture

amateescu CreditAttribution: amateescu commented

I like "View details for all votes" too, it's closer to the 'inspect all votes' machine name.

David4514’s picture

David4514 CreditAttribution: David4514 commented

"View details for all votes" as the title works for me.

My concern is that someone not familiar with this module will assume that the graphical representation with the vote counts represents the "detail" information. I fell into that trap before I finally figured out what my problem was.

A solution may be as easy including a description in a help page.

After a user submits their vote, they are shown a graphical summary of the current voting status identifying the current number of votes for each choice in the poll.

In addition, authorized users with "View details for all votes" permission, can access information about individual votes; timestamp, user name or ip address, and how the user voted.

DamienMcKenna’s picture

DamienMcKenna
Location NH, USA
CreditAttribution: DamienMcKenna commented
FileSize
drupal-n1347134-15-d7.patch532 bytes

FYI the patch in #1 for D7 has the wrong directory structure:

diff --git a/core/modules/poll/poll.module b/core/modules/poll/poll.module
index ec5452e..a60511e 100644
--- a/core/modules/poll/poll.module
+++ b/core/modules/poll/poll.module
@@ -111,7 +111,7 @@ function poll_menu() {
     'page callback' => 'poll_results',
     'page arguments' => array(1),
     'access callback' => '_poll_menu_access',
-    'access arguments' => array(1, 'access content', TRUE),
+    'access arguments' => array(1, 'inspect all votes', TRUE),
     'weight' => 3,
     'type' => MENU_LOCAL_TASK,
     'file' => 'poll.pages.inc',

D7 doesn't have a directory named "core". Try this one instead.

DamienMcKenna’s picture

DamienMcKenna
Location NH, USA
CreditAttribution: DamienMcKenna commented

Ignore #16, I hadn't read #4 yet. I guess to stop people being able to see the results page would take another permission, or a contrib module.

As you were.

X-)

DamienMcKenna’s picture

DamienMcKenna
Location NH, USA
CreditAttribution: DamienMcKenna commented

FYI this module might help people who need more flexibility on poll permissions: http://drupal.org/project/poll_extras

amateescu’s picture

amateescu CreditAttribution: amateescu commented
Status: Needs work » Needs review
FileSize
1347134-19.patch430 bytes

So, do we have an agreement on 'View details for all votes'? :)

David4514’s picture

David4514 CreditAttribution: David4514 commented

It is good for me!

c31ck’s picture

c31ck CreditAttribution: c31ck commented

Agreed.

xjm’s picture

xjm
she/her
Primary language English
CreditAttribution: xjm commented
Status: Needs review » Reviewed & tested by the community

I'll take the plunge. :)

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
CreditAttribution: webchick commented
Status: Reviewed & tested by the community » Fixed
Issue tags: +7.13 release notes

Given that at http://groups.drupal.org/node/210973 I didn't really get much pushback on the idea of having a looser standard of string translations for admin-facing strings, I think this is ok for D7.

Committed and pushed to 8.x and 7.x. Thanks for the clarification! Since this change breaks translations, tagging to mention in the 7.13 release notes.

xjm’s picture

xjm
she/her
Primary language English
CreditAttribution: xjm commented

Hmm, did we have replies from translators though? On the other hand, the string is clearly wrong so translations of it were probably wrong too.

Automatically closed -- issue fixed for 2 weeks with no activity.