Quantcast
Channel: Issues for Drupal core
Viewing all articles
Browse latest Browse all 313910

'edit/delete any content' permissions do not imply 'view any'

$
0
0

In some situations, users granted the 'edit any content' and/or 'delete any content' permission(s) are not able to view the nodes they can edit or delete. This is most apparent when considering unpublished nodes.

This could be fixed by implying this permission for any user granted the 'edit any' or 'delete any' permission, but a better, more secure solution is the addition of a new 'view any content' permission.

A seven-line patch is attached which provides this functionality, please consider for inclusion in future releases.


Viewing all articles
Browse latest Browse all 313910

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>