flag_get_flags() occasionally wants to return only the flags a particular user can access, and hence has an $account parameter.

Using this, it calls $flag->user_access().

Unfortunately, we want to change $flag->user_access() to look at the entity ID (for #879988: Flag permission for 'own entities'), and flag_get_flags() does this out of context of a particular entity:

- flag_form_alter(), which is daft because we check each flag for access a bit later on anyway.
- flag_form_node_type_form_alter(), which puts flag defaults in the node type form. This is potentially a bit trickier (though it's arguably a corner case: if a user can admin content types then they have pretty powerful rights on the site and I can't really think of cases where a user who can create content types and fields can't use all flags).

Hence we should remove this parameter and change the way both of these functions operate.

Comments

joachim’s picture

joachim commented

Huh.

> - flag_form_alter(), which is daft because we check each flag for access a bit later on anyway.

That actually causes a bug. This should be fixed as a separate issue so it can be more easily backported: #1882006: default value of global flags is not set on new nodes if creating user doesn't have access.

joachim’s picture

joachim commented

Argh, there's also hook_user_operations() and hook_node_operations(), which I hadn't spotted.

And those need to check user access to the flag, to decide whether to show it in the operations.

It may be that as we extend $flag->user_access() in #879988: Flag permission for 'own entities', we have to allow for it to only optionally get an entity ID.

joachim’s picture

joachim commented
Status: Active » Closed (won't fix)

See previous comment.