When creating access rules in the user.module, the edit screen (admin/access/rules/edit/) does not reflect the actual setting stored in the database and will always be 0 (Deny). Editing an existing access rule will therefore flip from Allow to Deny when one doesn't pay attention. This can potentially lock the drupal system.

Here is a code snippet from the user.module:user_admin_access_form function with the suggested change. I simply passed the $edit['status'] value to the #default_value which fixes the mis-beavior

function _user_admin_access_form($edit) {
  $form['status'] = array(
    '#type' => 'radios',
    '#title' => t('Access type'),
    '#default_value' => $edit['status'],
    '#options' => array('1' => t('Allow'), '0' => t('Deny')),
  );
<snip>

Comments

jhm’s picture

forgot to provide my environment:

Mac OS X 10.4.8
Apache1.3
PHP5.2.0

drupal.4.7.4 & drupal.5.0.beta1

jhm’s picture

Status: Active » Needs review
StatusFileSize
new528 bytes

I uploaded a patch

edmund.kwok’s picture

Version: 4.7.4 » 5.x-dev

Issue also exists in 5.0, changing version to get more attention.

Patch for 4.7 fixes the problem, please submit a patch for 5.0.

jhm’s picture

StatusFileSize
new542 bytes

Here is the patch against drupal5.0.beta1

edmund.kwok’s picture

Status: Needs review » Needs work

Looks like the diff was reversed :p

jhm’s picture

StatusFileSize
new542 bytes

Looks like the diff was reversed :p

Ooops. here is the correct version

edmund.kwok’s picture

Status: Needs work » Reviewed & tested by the community

Tested, and fixes the problem. RTBC

dries’s picture

Version: 5.x-dev » 4.7.x-dev

Committed to CVS HEAD. Needs to be backported, I think.

killes@www.drop.org’s picture

Status: Reviewed & tested by the community » Fixed

done

Anonymous’s picture

Status: Fixed » Closed (fixed)