Record edit permissions not working / only for superadmin
19 views
Skip to first unread message
4levels
Aug 29, 2010, 9:16:15 AM8/29/10
to diem-users
Hi Diem Team,
I've been spending the last 2 days to figure the following: I want a
certain user to be able to edit a record from within the frontend.
This works great if that user is super_admin. If however, I uncheck
the super_admin option and select all existing permissions, I keep
getting a 401 Unauthorized response in the ajax call after clicking
the big pencil in the front.
To me this seems like a missing permission in the database (which
exists in the code).
Anyone any ideas?
Keep up the great work!
@Thibault: good luck in Silicon Valley! Congrats with the
assignment ;-)
I've been spending the last 2 days to figure the following: I want a
certain user to be able to edit a record from within the frontend.
This works great if that user is super_admin. If however, I uncheck
the super_admin option and select all existing permissions, I keep
getting a 401 Unauthorized response in the ajax call after clicking
the big pencil in the front.
To me this seems like a missing permission in the database (which
exists in the code).
Anyone any ideas?
Keep up the great work!
@Thibault: good luck in Silicon Valley! Congrats with the
assignment ;-)
thibault
Aug 29, 2010, 9:47:53 AM8/29/10
to diem-...@googlegroups.com
Hi,
The required permission is 'record_edit_front'.
4levels
Aug 29, 2010, 10:06:20 AM8/29/10
to diem-users
HI Thibault,
as explained before: I selected ALL permissions (including the
'record_edit_front') for that user, but it still returns a 401. So
now this user can do everything as the admin (cause all permissions
are checked) except the edit of a record from within the front. Only
when I make this user super-admin, the form loads...
To me it seems like a $user->can() call with a non-existing permission
name (maybe just a typo) causing this issue as the super-admin option
bypasses the credential checks...
A search for record_edit_front gives only one result: dmFrontPlugin/
modules/dmWidget/config/security.yml
Doesn't this permission needs to be checked in the admin too as the
Ajax call opens the admin form?
Kind regards!
Erik
On Aug 29, 3:47 pm, thibault <thibault.duples...@gmail.com> wrote:
> Hi,
>
> The required permission is 'record_edit_front'.
>
as explained before: I selected ALL permissions (including the
'record_edit_front') for that user, but it still returns a 401. So
now this user can do everything as the admin (cause all permissions
are checked) except the edit of a record from within the front. Only
when I make this user super-admin, the form loads...
To me it seems like a $user->can() call with a non-existing permission
name (maybe just a typo) causing this issue as the super-admin option
bypasses the credential checks...
A search for record_edit_front gives only one result: dmFrontPlugin/
modules/dmWidget/config/security.yml
Doesn't this permission needs to be checked in the admin too as the
Ajax call opens the admin form?
Kind regards!
Erik
On Aug 29, 3:47 pm, thibault <thibault.duples...@gmail.com> wrote:
> Hi,
>
> The required permission is 'record_edit_front'.
>
thibault
Aug 29, 2010, 10:43:09 AM8/29/10
to diem-...@googlegroups.com
Looks like there was a bug. An old permission was used, that no more exists. I fixed it: http://github.com/diem-project/diem/commit/6e38cf3b2aea2a1d7849e3f9e3d9414fdbb9fd98
4levels
Aug 29, 2010, 10:53:50 AM8/29/10
to diem-users
Great!
Glad I found it and very grad you fixed it ;-)
Keep up the amazing work!
Erik
On Aug 29, 4:43 pm, thibault <thibault.duples...@gmail.com> wrote:
> Looks like there was a bug. An old permission was used, that no more exists.
> I fixed it:http://github.com/diem-project/diem/commit/6e38cf3b2aea2a1d7849e3f9e3...
Glad I found it and very grad you fixed it ;-)
Keep up the amazing work!
Erik
On Aug 29, 4:43 pm, thibault <thibault.duples...@gmail.com> wrote:
> Looks like there was a bug. An old permission was used, that no more exists.
>
> The widget_edit_fast_record is only used to propose the action button. Then
> the admin permissions are used to allow access to the admin edition page of
> the object.
>
> The widget_edit_fast_record is only used to propose the action button. Then
> the admin permissions are used to allow access to the admin edition page of
> the object.
>
Reply all
Reply to author
Forward
0 new messages