Issues regarding overriding ExhibitBuilder acl from plugin

[Andreas Sandlund]

In our project we have the need to change some of the permissions for the contributor role.

When it comes to items, contributors should be able to set items created by themselves as public.

Also, contributors should not be allowed to make their own exhibits public. This is instead handled by an administrator.

I've made a plugin that requires the ExhibitBuilder plugin to make sure its called after the EB-plugin.

I've also modified the ACL for Items in this plugin to allow contributors to make their items public:

$acl->allow('contributor', 'Items', array('showSelf','showSelfNotPublic', 'makePublic'));

The above is working as intended.

However, I'm not able to deny contributors the ability to set an exhibit as public. I'm using the following line:

$acl->deny('contributor', 'ExhibitBuilder_Exhibits', array('makeFeatured','makePublic','theme-config'));

It seems to be working for the 'theme-config' parameter since I get an error when trying to modify the theme. But the "make public" and "make featured" checkboxes still appear.

Is there anything I'm missing here?

[John Flatness]

The problem here is that Exhibit Builder just doesn't use the makeFeatured and makePublic permissions, so denying them doesn't do anything.

You _do_ get a make_exhibit_public event fired after a change from not public to public that you could use for this purpose, but you won't be able to easily hide the UI elements.

The existence of those finer-grained permissions for public and featured is pretty inconsistent across the codebase. I'm not sure why we haven't just built them into the mixin we already have for those... That's probably a good thing to change, but in the current version you're kind of stuck with what you've got.

-John