[TYPO3-core] [Fwd: RFC: hook request in t3lib/t3lib_userauthgroup.php]

[Dmitry Dulepov]

Hi!

Martin Kutschker wrote:
> I was speaking generally. What I mean is that I need to the time to 
> check IF your hook is potentially dangerous.

Ok :)

>> Currently if extension wants to implement its own access control for 
>> records, it can do it only through TCEMain hooks. But this has 
>> disadvantage. User goes to edit record, spends half an hour doing it, 
>> clicks "Save" and... gets a message that he has no rights for it.
> 
> That sucks.

Exactly :(

>> The hook that I proposed, allows extension to show "no edit access" 
>> message to user before he starts editing record.
> 
> Better. Do you intend to add some TV specfic checks or do you want to 
> add only the standard checks missign right now (eg the WS has 
> auto-versioning disabled and the page is not versioned and yet you see 
> the edit icon)?

It is specific check. TV now can disallow user access to specific data 
structure and template objects. If access is disallowed, user cannot 
edit corresponding FCE. Currently (without hook) "that sucks" thing will 
happen. If hook is used, user will see exactly the same screen as if he 
tried to edit a record that he has only read access to. So behavior 
becomes standard and consistent among the system.

> Generally I'm a bit wary when folks want to add a hook somewhere.

Me too, especially if hook is going to extend standard processing in 
potentially non-standard way. But here I simply could not reach 
consistent behavior without hook :( I tried everything.

 > As for
> the rest I'm with you for the same reasons. But hey, we both don't have 
> the time to review all of our patches - and we would still need a second 
> review.

Which brings us back to necessity of dedicated reviewers... :(

-- 
Dmitry Dulepov

Web: http://typo3bloke.net/
Skype: callto:liels_bugs

"It is our choices, that show what we truly are,
far more than our abilities." (A.P.W.B.D.)