A low-level CPS administrator (who does not have the "edit all changesets" permission) is only allowed to edit their own changesets, not the changesets of others.

However, they can still delete everyone else's changesets.

I thought about adding a "delete all changesets" permission to restrict this, but I think using "edit all changesets" for delete also probably makes sense (since in CPS if you can edit a changeset you can effectively empty it out with - as far as I can see - no way to easily get it back to its former state, which is therefore almost the same thing as deleting it).

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

David_Rothstein’s picture

Status: Active » Needs review
FileSize
1.07 KB

Here is a patch.

Fabianx’s picture

Status: Needs review » Reviewed & tested by the community

RTBC, this makes sense.

catch’s picture

Status: Reviewed & tested by the community » Fixed

Committed/pushed to 7.x-1.x, thanks!

  • catch committed 177db72 on 7.x-1.x
    Issue #2443431 by David_Rothstein: Users without the "edit all...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

Status: Closed (fixed) » Needs work

The last submitted patch, 1: cps-delete-changesets-2443431-1.patch, failed testing.

catch’s picture

Status: Needs work » Closed (fixed)