We have a situation where a user that has a role without permissions to administer nodes is able to bypass that restriction and use the VBO widget to mass-publish or -unpublish nodes on the system content view at
My thought was to unset the
unpublish values from the select box definition, but after debugging with
hook_form_alter, I discovered I could not see the element in the form definition.
I next tried to look at the view object with
hook_view_pre_view, but I don't see it there either?
How can I selective alter the VBO widget? We don't want to get rid of it altogether, but we can't have people without permissions publishing and unpublishing nodes.
Edit: I found this question, but it only explains how to delete those operations altogether, for everyone, which is not what we want. We only want them gone for people who don't have permission to publish or unpublish.