Needs work
Project:
Fusion Accelerator
Version:
7.x-2.0-alpha2
Component:
Code
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
6 Feb 2012 at 23:32 UTC
Updated:
8 Feb 2012 at 17:36 UTC
The "edit skins" link appears on the block configuration page at /admin/structure/block for users who do not have permission to edit skin settings.
Of course, when the user clicks "edit skins" get a 403 error page.
Comments
Comment #1
esmerel commentedI'm unable to replicate this on an authenticated user with just 'administer blocks' permissions. Can you give some more details on what permissions your user role has?
Comment #2
carsonwMy user/role has the following permissions:
administer blocks; view comments; post comments; skip comment approval; edit own comments; subscribe to comment notifications; use the site-wide contact form; use users' personal contact forms; use custom search; use custom search blocks; use exclude node title; use the filtered HTML text format; view media; view published content; use search; use advanced search; view published site map; view user profiles; change own username; cancel own user account
Comment #3
stephthegeek commentedAdminister blocks is a full administrative setting that gives you access to all block settings, which I would assume includes skins.
Comment #4
sheena_d commentedEditing skins is actually a separate permission defined by Fusion Accelerator, since editing skins is separate from actual block config (as opposed to Skinr in D6, where it was part of the block config page). This issue is probably happening because there is no really standardized way to hook into the links/tasks available on the block admin page, so we are basically just editing a template file and injecting in our link to the skins edit page. Obviously we need to add a permissions check there before we inject that link.
I will investigate a bit more and post a patch soon.