2

I have a SafeCracker form that will allow users to enter data about a trip. Users will not necessarily be logged in when submitting the form. For that I have set up a "Guest Posters" member group. That group contains a single "Guest Poster" user. That user's member_id is used for the logged_out_member_id parameter in SafeCracker.

That part all works fine.

Things fall apart when a user wants to edit a form submitted by somebody else. This can happen if, for example, an admin starts the form for a user and then hands it off to the user to complete the rest. In that scenario, if the user submits the form he sees the error: "You are not authorized to perform this action".

The error message originates because can_edit_other_entries ("Can edit entries authored by others" in the control panel) is set to 'n' for logged out users. But since I have that value set to 'y' for the "Guest Posters" group, I would expect the form submission to succeed.

I've stared at this for too long. At this point I figure there are two possibilities: either the solution is obvious and Friday fatigue has blinded me; or this is a bug in EE.

Any suggestions?

Improve this question
3
  • Is the user getting this message logged-in in this case, or no? If not, then your Guests group would have to be set to can_edit_other_entries. (It sounds like no one is ever actually logged-in to your "Guest Posters" group - entries just get assigned to that particular user.) – Derek Hogue♦ Jan 11 '13 at 20:58
  • Users are never logged in under the "Guest Posters" group. It is used only for SafeCracker's logged_out_member_id parameter. The "Guest Posters" group DOES have can_edit_other_entries set to 'y' as stated in the original post. – Mr. Wilson Jan 12 '13 at 16:16
  • Exactly. Since they are never logged-in to that group, the fact that the group has edit privileges is moot. They are always only "Guests", and hence, you must assign "Guests" edit privileges in order for this to work. – Derek Hogue♦ Jan 12 '13 at 16:36
2

The "Guest Posters" group (and associated member) you are using as the author for your guest-submitted entries is simply a way for Safecracker to assign authorship to an entry from a logged-out user. No user is ever actually logged-in with that account, so the editing privileges you assign to it are not important.

The default "Guests" member group is the one which would need privileges to edit other authors' entries, since your guest users, even if they have previously submitted entries, still belong to the "Guests" member group (because they have not logged-in).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.