When not logged in, an anonymous user shouldn't be able to access the forms to add wants or offers. However in the default installation these pages are presented and accessible, in concrete ces/bank/account/myoffers and ces/bank/account/mywants.

Comments

edumag’s picture

edumag CreditAttribution: edumag commented
Assigned: Unassigned » edumag
hemant_gautam’s picture

hemant_gautam CreditAttribution: hemant_gautam commented

Hi,

I am really not sure what is your issue because of lack of information. But as far as I understood, I think you need to know about the permissions to restrict page/menu level access.

https://api.drupal.org/api/drupal/modules%21system%21system.api.php/function/hook_permission/7

This above link is for creating your own permission and if you don't want to create new permission then you can check with the existing permissions.

Please let me know if this is useful for you.

Thanks.

wtebbens’s picture

wtebbens CreditAttribution: wtebbens commented

Well, let me point you to our installation of the integralCES modules in Drupal:
http://bancdeltemps.arenys.org/ices/

You can see that even without being logged in, you can get to the my offers and my wants pages:
http://bancdeltemps.arenys.org/ices/ces/bank/account/myoffers
http://bancdeltemps.arenys.org/ices/ces/bank/account/mywants

IMHO this shouldn't be the case, as there's no user logged in, so these froms shouldn't be accessible at all. Right?

hemant_gautam’s picture

hemant_gautam CreditAttribution: hemant_gautam commented

I understood. So as I said use Drupal permissions. For below two urls give permission to restrict for anonymous user.

ices/ces/bank/account/myoffers
ices/ces/bank/account/mywants

wtebbens’s picture

wtebbens CreditAttribution: wtebbens commented

thanks hemant_gautam. What I have done is to restrict access to the navigation block to logged in user roles, so anonmyous users can only get to the mentioned pages if they know the link. That makes it better, but the real thing remains: I have no permission control myself over those two forms myoffers and mywants - AFAIK. Or do you suggest I have? In admin/people/permissions there is no sign of managing the permissions of myoffers and mywants... but maybe there's another place?

edumag’s picture

edumag CreditAttribution: edumag commented

Integralces has its own system of permissions.

It's a bug that displayed myoffers.

Already looking to fix it.

edumag’s picture

edumag CreditAttribution: edumag commented
Status: Active » Closed (fixed)