D6 version not cross referencing incoming permissions with available permissions

The patch might need to go against the Permissions API for D6, actually, since this is a D7 core feature. Permissions API handles the backport of that functionality.

I doubt that the D7 cross-reference is to the credit of this module. It's probably from the core API handling, which is now checking the module the permission belongs to.

But if you are exporting permissions to code, making sure they are correct is your job, not the module's. Right? Enabling a permission for a module that doesn't exist (or is disabled) should have no effect.

So I think this is an API feature, not really a bug....

See http://api.drupal.org/api/function/user_role_grant_permissions/7 for the change.

Not sure this is possible in D6.

I agree that this is a feature request. It's really up to developers to make sure that staging code is called in the correct order, just like you can't import content types that reference CCK widgets that haven't been enabled.

Are errors or warnings being displayed when you try to set permissions that don't exist? If not, what's the desired outcome? Is this really even needed?

I'd love some more feedback from the community on this issue before I implement something.

Well, this is a feature that simply doesn't exist in D6. (I helped write the D7 patch.)

In D7, we check what module the permission belongs to, and store that so that permissions can be deleted when a module is uninstalled. This also means that you cannot add a disabled module's permissions using user_role_grant_permissions().

In D7, however, this is a more draconian approach to permissions (especially inheriting permission from other modules, like 'access content') that introduces module dependencies that are not a consideration to D6 module developers.

So since this doesn't harm anything, I'd be tempted to leave it alone in the D6 version.

Sounds like this needs to be moved over to the other project issue queue.

Possibly. I think the question is, should permissions_grant_permissions() do the filtering, or should the caller.

It's my opinion that the caller should do the filtering. In D6, I have no way of knowing with 100% accuracy what module each permission belongs to. Two modules can define the same permission string; as such, I can't reliably do any filtering. This may be a rather weak argument though. :)

You could filter on $permissions = array_values(module_invoke_all('perm')); with the array_intersect(), like this patch does.

Otherwise, feel free to throw this back in my queue.

Thanks Matt V. and agentrickard for the patch and discussion - I have fixed this in the latest commit.

http://drupal.org/cvs?commit=368434