In the past Protected Node was able to control view access and edit access to protected nodes separately, using 'view protected content' and 'bypass password protection'. The language was a little unclear and definitely need improving, but #2424571: Is "view protected content" permission redundant? went and removed it altogether, lumping edit access together with view access. I'd like to suggest we roll back that patch, and just come up with some better permission names and descriptions to make it clear what is going on.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Grimreaper’s picture

Hello,

I think it would have been better to re-open the related issue.

Case access protected content bypass password protection edit any password edit my content type password edit my content type
No access at all to the ressource 0 0      
Need to enter the password to see the ressource 1 0      
Bypass completely the protection   1      
Edit node passwords       1  
Edit node without modifying the password   1     1

Are you ok with this permission matrix?

Khalor’s picture

I think the first point of confusion was the 'access protected content' (which implies actual access to the node) in actuality only allows the user access to the password input screen instead of getting a regular access denied. So we should change that to 'access password dialog' or something similar.

Then restoring 'view protected content' (view without password) makes more sense - possibly change the 'bypass' permission label to something like 'edit protected content' (which implies view access as well).

So the matrix would look like this:

Case access password dialog view protected content (bypass password) edit protected content (bypass password) edit any password edit my content type password
No access at all to the ressource 0 0        
Need to enter the password to see the resource 1 0        
Can view resource without password, need to enter the password to edit the resource 1 1        
Bypass completely the protection (can edit and view without password)     1      
Edit node passwords         1  
Grimreaper’s picture

Hello,

I agree that your labels are easier to understand, so the permission matrix is more natural.

Just waiting the opinion of Izus the other co-maintainer. If it is ok, I will make the patch.

To complete the matrix, for features which add tabs on the node like webform, or the node/nid/delete. I don't know if those responsibilities should be in "edit protected content (bypass password)" or in two permissions like "delete protected content (bypass password)" and "access protected content other tabs (bypass password)"

izus’s picture

Hi,
i agree with the split

let's not use the terme 'dialog' as this is a waanted feature that is not in for the moment (we just redirecte to a form) and let's also be clear with terms : edit any password => edit any protected node password

i also think that the module should keep on "view" part and not deal with the delete operation.

we'll need to set new permissions automatically (hoo_update_n) to not break existing site permissions

a clear matrix in the readme.txt would begreat too :)

Grimreaper’s picture

Assigned: Unassigned » Grimreaper
Status: Active » Needs review
FileSize
13.31 KB

Hello,

Here is a patch that change the permissions.

Thanks to test and review it.

When it will be ok, I will also update the README.txt and the online documentation.

izus’s picture

Status: Needs review » Needs work
  1. +++ b/protected_node.module
    @@ -75,27 +75,35 @@ function protected_node_help($path, $arg) {
    +    'access password form' => array(
    

    access protected node password form

  2. +++ b/protected_node.module
    @@ -75,27 +75,35 @@ function protected_node_help($path, $arg) {
         'edit any password' => array(
    

    can we also change this to "edit any protected node password", would be clearer

Thanks

Grimreaper’s picture

Status: Needs work » Needs review
FileSize
15.36 KB

Thanks for the suggestions.

I remade the patch with.

Waiting any feedback before merging.

Khalor’s picture

Looks good to me, nice work!

Khalor’s picture

Status: Needs review » Reviewed & tested by the community
izus’s picture

Status: Reviewed & tested by the community » Needs work

Before the patch we had 3 permissions:
'access protected content'
'bypass password protection'
'edit any password'

After the patch we have 5 permissions:
'access protected node overview page'
'access protected node password form'
'edit any protected node password'
'view protected content'
'edit protected content'

The 5 permissions are all new ones. In order to not break permission system of existing sites we should handle all the new permissions default configuration based on the old permissions

Grimreaper’s picture

Hello,

Just in time, I was about to merge :)

'access protected node overview page' <- 'administer site configuration'
'access protected node password form' <- 'access protected content' DONE
'edit any protected node password' <- 'edit any password' DONE
'view protected content' <- 'bypass password protection' ???
'edit protected content' <- 'bypass password protection' DONE

If you are ok with this mapping I will update the patch.

I will also have to update the README.txt and the documentation page.

izus’s picture

yeah i think something like this will do it :)

Grimreaper’s picture

Status: Needs work » Needs review
FileSize
16.85 KB

Ok, finally I have done:

'access protected node overview page' <- 'bypass password protection'
'access protected node password form' <- 'access protected content'
'edit any protected node password' <- 'edit any password'
'view protected content' <- 'bypass password protection'
'edit protected content' <- 'bypass password protection'

Currently it is bypass password protection for the overview page. And I have added the matrix in the README.txt

Thanks for the review.

izus’s picture

read the code quickly and seems good.
letting someone that applies it and tested interface mark it as RTBTC or to Grimreaper to retest and merge :)

Grimreaper’s picture

Ok, thanks.

I will wait a few days (3 - 7) or until someone else respond to merge.

Grimreaper’s picture

  • Grimreaper committed a328ef5 on 7.x-1.x
    Issue #2482419 by Grimreaper, izus, Khalor: Split view and edit...
Grimreaper’s picture

Status: Needs review » Fixed

This is now merged.

Thanks all.

  • Grimreaper committed 58c0b82 on 7.x-1.x
    Issue #2482419: Better permission matrix in README.txt.
    

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.