People view should show users with view permission in addition to those with edit permission

Created on 13 July 2020, over 4 years ago
Updated 14 April 2024, 7 months ago

Motivation

Introduce a new "viewer" (aka. reporter) role on the site that only has access for entity listing and entity view (canonical) pages. By using this module and combining the "View users with allowed roles" and "Access the users overview page" permissions it is possible to limit the displayed users on admin/people, but the logic in administerusersbyrole_query_administerusersbyrole_edit_access_alter() incorrect and the admin/people page remains empty. The reason behind that is fairly simple, the viewer role does not have "Edit users with allowed roles" (because it must not have) therefore all the query alter adds a constraint that makes sure no result is being returned. Although a user's profile page can be still accessed by a viewer, if it knows the URL of the page.

Proposed solution

  • Create a new tag administerusersbyrole_access which grants permission if user has the permissions from this module to view or edit or assign roles.
  • Alter the people view from this module to use the new tag
  • Extend test coverage (maybe - I could be flexible about that)
🐛 Bug report
Status

Needs review

Version

3.0

Component

Code

Created by

🇭🇺Hungary mxr576 Hungary

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024