In one of my plugins I let the owner of an entity designate other team members who can view it:
$entity->team_access_list = create_access_collection("Our Team: $entity->title", $my_guid); $entity->save(); $team_guids = // some function to return GUIDs of team members update_access_collection($entity->team_access_list, $team_guids);
This works as intended. Only members of the team can see the entity. I also let the owner set the read access to public instead, so anyone can see it:
delete_access_collection($entity->team_access_list); $entity->deleteMetadata('team_access_list'); $entity->access_id = ACCESS_PUBLIC; $entity->save(); register_error("Entity access_id: $entity->access_id"); // yay, shows 2
But it's not actually setting the access_id back to public. access_id is staying set to the access collection id, and I can't seem to change it. I can only get it set back to ACCESS_PUBLIC if I trigger the above code as the site admin.
I haven't done a lot with ACL's in Elgg, so I'm probably missing something obvious. Any ideas? Thank you!
info@elgg.org
Security issues should be reported to security@elgg.org!
©2014 the Elgg Foundation
Elgg is a registered trademark of Thematic Networks.
Cover image by Raül Utrera is used under Creative Commons license.
Icons by Flaticon and FontAwesome.
- Nikolai Shcherbin@rivervanrain

Nikolai Shcherbin - 0 likes
- Josh Henly@Josh.Henly

Josh Henly - 0 likes
- Nikolai Shcherbin@rivervanrain

Nikolai Shcherbin - 0 likes
- Josh Henly@Josh.Henly

Josh Henly - 0 likes
- Nikolai Shcherbin@rivervanrain

Nikolai Shcherbin - 0 likes
- Josh Henly@Josh.Henly

Josh Henly - 0 likes
- Nikolai Shcherbin@rivervanrain

Nikolai Shcherbin - 0 likes
- Josh Henly@Josh.Henly

Josh Henly - 0 likes
You must log in to post replies.Try don't use delete_access_collection($blog->team_access_list);
Thanks for the suggestion, RvR. I tried that but unfortunately the same issue is occurring.
It's really puzzling to me that I can do:
..and it shows the id is 2. But the next time I access the entity the access_id is set back to the value of $entity->team_access_list. It's almost like my user doesn't have write access on the access collection it created, nor the team_access_list metadata it created.
Put your code in
ignore_access
function:Thanks RvR. No dice though. Just as before, my register_error() indicates the access_id is 2 immediately after saving. But anytime thereafter when I examine the access_id it's still set to the access collection id that was originally created.
However, I did discover that $entity->deleteMetadata('team_access_list') is working properly at least. When I view my entity I'm printing out access_id / $entity->team_access_list, and I see "123 / "
I'm starting to wonder if I have some other plugin that's interfering with my write access to the access collection. I certainly can't seem to delete it unless I'm operating on it with the admin account.
Maybe an access level override is being triggered somewhere in your code.
Ok, I think I have an idea what's going on, though I'm still not sure of the root cause.
I found that if I change the access_id during an action (like the edit action of the entity in question), it works fine. But if I change the access_id in a view, or change it when the action is invoked via AJAX, it doesn't work.
I could see why Elgg wouldn't allow access_id (or other entity properties) to be modified in views. I'm not sure why calling my action from AJAX seems to have the same issue.
No code, no ideas ¯\_(ツ)_/¯
Hahah, fair enough.
I finally figured this out: I discovered that my entity has a canEdit() function that was returning false under some circumstances. Those circumstances just happened to coincide with when I was attempting to call my actions via AJAX. So the AJAX was a red herring after all.