Roles override in View pages does not function as user might think [#1380402]

If I make a View with two pages and I want to differentiate between the Access roles between the two View pages, I need to
1. Override access role by pressing "Role"
2. Override the role at that page. Apply.
3. Press "Multiple roles" and override the page and set roles. Apply.
4. Save.

One might think that changing role access works only by
1. Pressing "Multiple roles"
2. Overriding the page
3. Setting a role
4. Save.

If I don't first override the Access role both the View pages will have the Access options chosen -> I can't have to different access options in a same View.

Comments

Comment #1

tangamampilia commented 17 February 2012 at 07:05

Yes, your solution is the only one way to override the roles :-/

Comment #2

dawehner

German

commented 17 February 2012 at 07:53

Status:

Needs work

» Closed (works as designed)

Yeah that's right, that's the expected behavior. In previous version of views you had the override button just on the access type selection, which annoyed other people as well.

I'm sorry but changing this would break other things.

Comment #3

djg_tram commented 27 February 2012 at 18:56

Status:

Closed (works as designed)

» Needs review

That doesn't seem to be the real problem. I have a triple view, all three are pages and I simply can't change the access rights on the third one. I'm fully aware of how to change it with "This page (override)" but all three pages get it changed all the time. And there will be no italics on the third page to show the overridden status.

Comment #4

dawehner

German

commented 27 February 2012 at 19:05

Status:

Needs review

» Active

Needs review means that there is an actual patch.

@djg_tram
Do you try to change the settings on the access settings, though having the acccess type not overridden? I'm just wondering, because you didn't described that.

Comment #5

djg_tram commented 27 February 2012 at 21:59

I have three pages, 1, 2 and 3. In the beginning, all have the same access (not by role but by permission). Then I try to modify the rights to page 3. I make sure I have "page override" selected when I change to a different permission. Only Page 3 gets the asterisk showing that it was modified but all three pages get the new permission, and there is no override for Page 3.

All relevant modules are up-do-date.

Comment #6

xatoo commented 7 April 2012 at 11:07

Version:	7.x-3.x-dev	» 7.x-3.0
Component:	Code	» User interface
Assigned:	Unassigned	» tipit
Category:	bug	» support

I can confirm this bug. It was reproduced with the steps in #5 and using views 7.x-3.x-dev, core 7.12.

Also the same problem occurs with two pages.

- Access to the default view, so both pages, is given to role A and B.
- I want to override page 2 to only allow role B to access the view. So I deselect role A and make sure I select "override" in the dropdown.
- I see that only page two is marked with an asterisk, as expected. But even before saving, when I go to page 1, I see that role A has been deslected there as well.

The strange thing is that when I override page 1 instead of page 2, then it works fine.
Since access restrictions are changed without the knowledge of a user I would consider this to be quite a security issue.