1

I'm looking a bit into the Rules module and it seems to have a lot of possible uses.

However, one thing isn't really clear to me. Are Rules dependent on the current user's permissions? For example, if a user doesn't have permission to change a certain content node, but he can do something that triggers a rule that changes that content node, will the node be changed or not?

With other words, are rules executed from "administrative" permissions or from the current user's permission?

Update: I've tested out 2 permissions. Creating a content node and editing a content node by using rules when the user doesn't have permission to do so directly. In both those cases Rules doesn't follow the current user's permission and creates/edits the node without a problem. Of course this is by no means exhaustive testing, but for simple node-related operations Rules isn't hindered by the user. (Using the latest version of Drupal and Rules) If it ever is, I've selected the answer that bypasses the problem.

2
  • Welcome to the amazing world of rules in D7 (patience needed for D8 ...). You may want to have a look at this question (I leave it to others to decide if it is a duplicate or not). However, "I" would be interested in an updated version of your question, which includes your results you got with whatever you tried so far, together with any related question you may have about those results. Take your example, massage it in an as-good-as-it-gets-rule, and experiment with user1 without those permissions (+ user 2 who does have them). – Pierre.Vriens Aug 19 '16 at 13:11
  • Will update tomorrow with my specific case and I'll test it further when I have some free time. – Robin De Haes Aug 19 '16 at 22:55
1

I've definitely run into problems with this before and it's pretty annoying..

One possible way out of it is to create an extra role with the required permission and in rules, add it, force save user, do stuff, remove role.

6
  • So it does take the current user's role into account? That's too bad. Your approach sounds great though. Just to make sure I get it right: I can add the administrator role to the current user, save the user, perform my actions, and remove the role again. (Do I need to save the user at the end as well or will this happen automatically?) – Robin De Haes Aug 19 '16 at 11:17
  • Don't add admin role.. You never know when something could crash before the role can be removed. Create a new role and only check the specific permission needed. I'm about 80% sure on all of this.. It's been a long day. That should happen automatically at the end. – Niall Murphy Aug 19 '16 at 11:20
  • Ok, thanks. Iwill check it out and select you as the answer tonight (or tomorrow). – Robin De Haes Aug 19 '16 at 11:23
  • Whatever you do, don't give the "Bypass Rules access control" permission to the user role. At first glance, it sounds like it might help but it allows that user to edit rules. – Niall Murphy Aug 19 '16 at 11:28
  • Niall's answer is true, but I wouldn't recommend it. Also, IMO it does not answer the actual question. And if you use such approach in a site where there are IT Auditors walking around (banks, airlines, etc), they won't like it (and you don't want to make them come after you...). They might say something like "there must be a good reason why user X has no authority, so don't allow user X to (temporarily) impersonate user Y who has the authority". – Pierre.Vriens Aug 19 '16 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.