This is because the auto-generated menu item for module that implement hook_hook_info() is lacking an access_callback.

Patch should theoretically apply to both D6 and D7, but I've only tested it on D6.

CommentFileSizeAuthor
trigger_broken.patch553 bytescwgordon7

Comments

cwgordon7’s picture

cwgordon7 commented

This would actually work for user 1, by the way, because access_callback is being automatically set to user_access so it doesn't matter that no "Modulename" permission exists. To reproduce, try accessing the trigger page of a non-core module as any user besides user 1.

Status: Needs review » Needs work

The last submitted patch, trigger_broken.patch, failed testing.

cwgordon7’s picture

cwgordon7 commented
Version: 7.x-dev » 6.x-dev
Status: Needs work » Needs review

My bad, this issue has been (coincidentally?) fixed in Drupal 7, the issue is only with Drupal 6.

avpaderno’s picture

avpaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
commented
Status: Needs review » Reviewed & tested by the community

The patch is simple, and easy.

gábor hojtsy’s picture

gábor hojtsy
he/him
Primary language Hungarian
Location Hungary
commented
Version: 6.x-dev » 7.x-dev
Status: Reviewed & tested by the community » Needs review

Still seeing no access callback specified there in D7:

  foreach ($trigger_info as $module => $hooks) {
    $info = db_select('system')
      ->fields('system', array('info'))
      ->condition('name', $module)
      ->condition('status', 1)
      ->execute()
      ->fetchField();
    if ($info) {
      $info = unserialize($info);
      $nice_name = $info['name'];
      $items["admin/structure/trigger/$module"] = array(
        'title' => $nice_name,
        'page callback' => 'trigger_assign',
        'page arguments' => array($module),
        'access arguments' => array('administer actions'),
        'type' => MENU_LOCAL_TASK,
        'file' => 'trigger.admin.inc',
      );
    }
  }
gábor hojtsy’s picture

gábor hojtsy
he/him
Primary language Hungarian
Location Hungary
commented
Version: 7.x-dev » 6.x-dev
Status: Needs review » Fixed

Uhm, they just replaced the custom checking with a general user permission. Hah. I think in D6 the expectation was that the user access callback would be inherited. Committed.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.