Currently, only users with "administer nodes" can set a book page's weight.
I wanted one but not the other, so I added an extra role to book called 'set book page weights'.

It seems like this might be useful for others, so I'm submitting this as a (trivial) patch.

CommentFileSizeAuthor
book_weights.patch908 bytesNick Urban

Comments

M.J. Taylor’s picture

The attached code by Nick isn't complete as it does not save the changed weight. Also, I'm not that familiar with the +/- system in the .patch, but it seems the usage in the .patch is backwards? This functionality (core hack) seems really useful, as there are many instances where you would not want to allow someone to administer nodes, but you would want them to be able to weight their own book pages. My recommendation is to move this functionality into core.

Note: While I'm not a php programmer, this does work on my installation. It was written for version 4.7, but the given the slight difference between book.module 4.7.x and 5.x is will probably work in either.

Oh, a review by someone who knows php would be nice,

M.J. Taylor
Publisher
from Reason to Freedom

Instructions:

In book.module:
Remove lines with "-"
Add lines with "+"

In Administer >> access control
Set permissions 'set book page weights' for those you want to be able to do it.

START APPROX LINE NUM: 20
function book_perm() {
-    return array('outline posts in books', 'create book pages', 'create new books', 'edit book pages', 'edit own book pages', 'see printer-friendly version');
+    return array('outline posts in books', 'create book pages', 'create new books', 'edit book pages', 'edit own book pages', 'see printer-friendly version', 'set book page weights');
}


START APPROX LINE NUM: 225
function book_submit(&$node) {
  // Set default values for non-administrators.
-  if (!user_access('administer nodes')) {
+  if (!((user_access('administer nodes')) or (user_access('set book page weights')))) {
    $node->weight = 0;
    $node->revision = 1;
  }
}


START APPROX LINE NUM: 240
function book_form(&$node) {
 . . .
-  if (user_access('administer nodes')) {
+  if ((user_access('administer nodes')) or (user_access('set book page weights'))) {
    $form['weight'] = array('#type' => 'weight',
      '#title' => t('Weight'),
      '#default_value' => $node->weight,
      '#delta' => 15,
      '#weight' => 5,
      '#description' => t('Pages at a given level are ordered first by weight and then by title.'),
    );
  }
Nick Urban’s picture

Hi MJ,

The code I submitted works fine for me. It allows users with the specified permission to edit the book weight.
I don't think it's necessary to set a default weight in book_submit, as there should already be a default value.

Also, I'm not positive, but it looks like your changes in book_submit might allow a user with the 'set book page weights' permission to modify the revision and owner id. I say this because the purpose of that hook seems to be to override the set uid and rev with safe defaults, implying that perhaps they could otherwise be set to nonsafe values. Only a node administrator should be allowed to do that, but now it looks like you've allowed anyone with the right to modify weights to make those same changes.

Please correct me if I'm wrong.

Nick

pwolanin’s picture

Version: 5.1 » 7.x-dev

New features will only be added to the latest Drupal version.

Note, in the 6.x version all users can set the weight if they are allowed to add content to books.

M.J. Taylor’s picture

Version: 7.x-dev » 5.1
Status: Active » Closed (won't fix)

Hi Nick,

Couple clarifications. My statement about your patch not working correctly needs to be modified to be true for D4.7 not for D5. With the insanely rapid upgrade path of Drupal, we're skipping D5 entirely and possible D6 too, as D7 seems to be already be in HEAD. It's basically not worth our time upgrading custom modules for already dead versions. . .

And you are correct, my code is too permissive, as it allows users to modify weights for nodes they don't own. I should have noted that here earlier, as once I found it I pulled it from our production system. I'll post my 4.7 patch re-write when I finish it.

Pwolanin, I'm moving this back to 5.1 as that is what Nick's patch applies too. And taking your statements into account, I'm moving the status to “won't fix,” as that is more accurate than the status “closed.”

Thanks Nick for pointing my error out so others didn't use it,

MJ