Any user with 'access administration pages' permission can see the site logs by going to /admin, but watchdog.module requires 'administer watchdog' permission to view them at /admin/logs.
This isn't a major issue; users with access to some of the admin pages are probably allowed to see the logs anyway, but it's inconsistent. Changing system_admin_page() to check for 'administer watchdog' and display either a blank page or a brief help text would make it neater ;)
| Comment | File | Size | Author |
|---|---|---|---|
| #6 | help.module_2.patch | 626 bytes | mgifford |
Comments
Comment #1
vigo-1 commentedAgreed, this issue confused a couple of my clients last month. Will work up a patch.
Comment #2
wulff commentedThe 'administer watchdog' permission has been removed.
'access administration pages' now applies to both admin/ and admin/logs.
Comment #3
(not verified) commentedComment #4
Leeteq commentedref. "'access administration pages' now applies to both admin/ and admin/logs."
This is a very limiting "combination". I fail to see good reasons why this should be so.
- meanwhile (whether it gets changed or not) - is there a way to restrict access to logs so it is based on other roles than those who have the permission to access the admin pages?
There are several problematic consequences of this combination:
* cannot give access to admin/help without revealing the logs... (that is another issue, why the help pages are placed "behind" admin access at all, very strange and unproductive)
* cannot delegate permissions to do basic content management such as moderation or RSS/syndication management without revealing the logs...
* cannot give external designers access to administer themes/theme modules without revealing the logs...
These consequences are in many situations plain showstoppers and causes unnecessary extra work, plus bad impression of Drupal for others that should be invited to participate in shaping sites.
Comment #5
Steven commentedComment #6
mgiffordThis is a really simple change to address the problem with the help pages. I was completely floored when I found out that the help functionality simply wasn't available to those who needed it most. If you're setting up a site where everyone has admin access then I can see not needing to separate 'access administration pages', but so site now have many different levels of contributors who you may want to give direct access to the help pages so that they can answer their own questions by reading the docs.
Anyways, please consider adding this change to the help.module page for future releases.
16c16
< $admin_access = user_access('access administration pages');
---
> $admin_access = ( user_access('access administration pages') || user_access('view help') );
34a35,38
> function help_perm() {
> return array('view help');
> }
>
Comment #7
pasquallethis isn't enough.. search for string "admin/help". It is everywhere..
Comment #8
damien tournoud commentedDeprecated by the work on the new help system #299050: Help System - Master Patch.
Comment #9
Anonymous (not verified) commentedAutomatically closed -- issue fixed for two weeks with no activity.