poll.module seems to be unaware that the meaning of the 'administer nodes' permission has been changed, and that there is a new 'bypass node access' permission that has some of the former functionality of 'administer nodes'.

In node.module, 'administer nodes' gives you permission to administer revisions, and to set publishing/sticky options, and to change the authorship of nodes. 'bypass node access' gives you permission to create, edit, or delete any node.

In poll.module, specifically poll_form() and _poll_choice_form(), it seems to be using 'administer nodes' permission to allow the user to edit/delete any poll. I think it should be using 'bypass node access' instead, or perhaps in addition.

CommentFileSizeAuthor
#3 poll.module.patch824 bytesglipay

Comments

sun’s picture

sun
Primary language German
Location Karlsruhe
commented

Just jumped on this. Actually, "administer nodes" makes more sense here than "bypass node access" - as it's used to allow to alter the amount of current votes for each choice. Not entirely sure how that is possible and compatible with the actual votes recorded per user, but hey, alright, okay.

If there was a "administer polls" permission, that would be it. But there ain't.

Given all of these options, I'd either say we just pretend to not know of this issue, or we bump to D8, or we introduce "administer polls" last-minute.

jhodgdon’s picture

jhodgdon
she/her
Primary language English
commented

I'm not objecting to administer nodes giving you permission to change the poll votes.

I'm objecting to administer nodes giving you permission to create, edit, delete any poll node.

glipay’s picture

glipay commented
Assigned: Unassigned » glipay
Status: Active » Needs review
StatusFileSize
new poll.module.patch824 bytes

I changed the user access check to bypass node access instead of administer nodes and left the exsting permissions for the access check to change poll votes.

sun’s picture

sun
Primary language German
Location Karlsruhe
commented

That looks like a valid start. I hope jhodgdon agrees.

I'm objecting to administer nodes giving you permission to create, edit, delete any poll node.

Actually, is there more to it? Or just that one line?

jhodgdon’s picture

jhodgdon
she/her
Primary language English
commented
Status: Needs review » Reviewed & tested by the community

No, that's it -- just that one line. Bypass Node Access is the permission that is supposed to let you do CRUD actions on all nodes, not Administer Nodes, in D7.

This patch looks fine to me. I agree that the other use of 'administer nodes' is OK.

dries’s picture

dries commented
Status: Reviewed & tested by the community » Fixed

Yep. Committed to CVS HEAD. Thanks.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.