User Management Batch Update Options should include assign and remove role

shark, I agree that this is an essential feature.

I'm attaching a patch that I believe implements this. Please review and test. After applying the patch, be sure to clear your Drupal cache before going to admin/user/user to see the new batch operations.

Note to role_delegation maintainer(s): I borrowed most of role_delegation_user_operations() from user_user_operations() in user.module.

Hm. Although this works, it causes the user module to emit a 'Detected malicious attempt to alter protected user fields' warning in the log. I'll look into this.

OK, here's a revised patch that fixes the log warnings. I had to change the operation names from e.g. add_role to role_delegation_add_role, so that user_user_operations() wouldn't worry about the permissions. Please test.

Comment cleanups.

This patch is tested and ready. Can we get it incorporated into a new release? Thanks, Andrew.

Committed to the DRUPAL-6--1 branch. Thanks for not giving up! :)

This will need to be ported to Drupal 7.

Here's a port of this feature to D7.

The approach I used here for providing the operations is a little different than in D6. In the D6 patch I submitted, role_delegation_user_operations() returns a nested array of operations, e.g.

array(
  'Add a role to the selected users' => array(
    'role_delegation_add_role-1' => 'Role 1',
  ),
  'Remove a role from the selected users' => array(
    'role_delegation_remove_role-1' => 'Role 1',
  ), 
)

This is actually not right. The API for hook_user_operations (not available for D7 yet, but it's the same) is clear that hook_user_operations() should only return a simple array of operations, not a nested array. However the above works, because in the form API, form_select_options() does accept nested arrays of options, which it renders as optgroups.

A better approach is to return a simple array, as the API requires, of properly labeled operations, e.g.

array(
  'role_delegation_add_role-1' => 'Add role: Role 1',
  'role_delegation_remove_role-1' => 'Remove role: Role 1',
)

Then separately alter the user bulk update form to present these as nested options, as before. The user sees the same thing, but we follow the API, so the operations can also be used elsewhere (e.g. in VBO) and be properly labeled there.

This is what I did for D7. The correction could also be applied in D6, but it's probably not worth the trouble since the existing code works.

Here's a slightly corrected patch:

• Still checks for unauthorized role assignment even if the operation list is empty.
• Checks array_key_exists() so as not to cause an 'undefined index' error in case of a watchdog warning.

Fixed committed in 7.x-1.x-dev.