Problem/Motivation
It took me a long time to figure out what the Node - Administer Content (internally known as administer-nodes) permission was for. Documentation for it elsewhere is scarce and IMHO the title (which we can't change now, clearly) is misleading.
The description (after the usual "trusted role"' warning) reads:
Promote, change ownership, edit revisions, and perform other tasks across all content types.
To me, the title "Administer Content" implies full edit permissions, but that's not the case, e.g.:
- It doesn't allow you to edit all nodes - you get no choices in the Operations column on /admin/content without individual create/edit/delete permissions for specific content type or the "Bypass Content Access Control" permission
- It doesn't allow you to view or edit content types (/admin/structure/types) - that's what Administer Content Types is for (plus "Use the administration pages and help")
- Attempting anything in the /admin/content Actions dropdown will also give a No access message - e.g. marking the content as sticky, promoting it, changing the publish state etc.
- You can't access /node/1/revisions with Administer Content alone.
From my testing and checking the source code, it seems, providing I already have permission to edit a content type (without this you can't do anything), Administer Content gives me the Author (uid, created) and Promotion (promoted, sticky) panels on the edit screen, plus the Revisions tab.
NB: we still refer to "administer nodes" rather than "administer content" in a few places ("Role requires" text in other permissions) - I've submitted a separate patch to fix this.
Proposed resolution
Can we:
- remove or clarify the ambiguous 'perform other tasks'
- indicate "Administer Content" needs to be used in conjunction with edit permissions / doesn't allow editing on it's own
- consider position/relative importance of Administer Content vs Bypass Content Access Types etc. in permissions list (which combination do most users need?)
Current suggested new text:
Warning: Give to trusted roles only; this permission has security implications. Change ownership, date/time, promote or make sticky and edit past revisions for content in all content types. Does not include view, edit or delete.
Remaining tasks
Agree wording. Write patch.
User interface changes
New description on /admin/people/permissions.
API changes
None.
Data model changes
None.