Users able to delete their own activity ?

This error also appears in Version 6.x-1.x-dev.

The problem is that module is looking too see if the user has "Administer Activity" permissions. There needs to be a new permission added to the activity module that allows the admin to set "Administer Own Activity" permissions. Giving the user generic Administer Activity permissions allows the user to delete any activity not just there own.

546 /**
547  * Check if user has right to delete a single activity record and if
548  * so, return a the activity record delete link.
549  */
550 function activity_delete_link($activity) {
551  global $user;
552
553  if (($user->uid != 0 && $activity['uid'] == $user->uid) || user_access('administer activity')) {
554    return theme('activity_delete_link', $activity);
555  }
556  return NULL;
557 }

My quick solution is to add the following to my template.php file to not show the Red X for deleting the activity. This prevents anyone from hovering over a single activity entry and deleting.^*

/**
 * Theme function to create a link to delete a single activity record.
 */
function light_activity_delete_link($activity) {
 // return l('X', 'activity/delete/'. $activity['aid'], array('attributes' => array('title' => t('Delete this activity record'), 'class' => 'activity-delete-record'), 'query' => drupal_get_destination()));
    return NULL;
}

^*light is the name of theme.

am adding a permission for 'delete activity'. This combined with some other changes should address this issue. Will check back later after I've committed the changed. Basically the delete link will only be shown if the user has administer activity permission OR if they have delete activity permission AND are the user (uid) of the activity record.

The activity delete link (which could be accessed by going straight to an activity delete URL) also has a second check for permission to delete the activity.

I've attached patches for d5 and d6 versions. If anyone can help me test I would appreciate it.

Hey jay, I applied the patch to my dev site and tested out a bunch of scenarios, and everything seems to be working perfectly (I gave Delete Activity permissions to authenticated users).

They're able to delete only activity that originated with them (and the deletionX shows only mousing over these items).

I'll report back if there are any issues that I come across, but so far so good.

Thanks -

tagging

These both look good, but I'm curious as to why you didn't take the same approach in the d5 version of the patch? You could do your logic around the menu item to make sure that is_numeric(arg(2)) and then use the 'access' => activity_delete_access(arg(2)),

I'd have to check again but I ran into problems that I figured were associated with menu caching of access.

committed to dev.

So is this feature available for Drupal 5x ?