SafeCracker, guests, and can_edit_other_entries

Question

I have a SafeCracker form that will allow users to enter data about a trip. Users will not necessarily be logged in when submitting the form. For that I have set up a "Guest Posters" member group. That group contains a single "Guest Poster" user. That user's member_id is used for the logged_out_member_id parameter in SafeCracker.

That part all works fine.

Things fall apart when a user wants to edit a form submitted by somebody else. This can happen if, for example, an admin starts the form for a user and then hands it off to the user to complete the rest. In that scenario, if the user submits the form he sees the error: "You are not authorized to perform this action".

The error message originates because can_edit_other_entries ("Can edit entries authored by others" in the control panel) is set to 'n' for logged out users. But since I have that value set to 'y' for the "Guest Posters" group, I would expect the form submission to succeed.

I've stared at this for too long. At this point I figure there are two possibilities: either the solution is obvious and Friday fatigue has blinded me; or this is a bug in EE.

Any suggestions?

Answer 1

The "Guest Posters" group (and associated member) you are using as the author for your guest-submitted entries is simply a way for Safecracker to assign authorship to an entry from a logged-out user. No user is ever actually logged-in with that account, so the editing privileges you assign to it are not important.

The default "Guests" member group is the one which would need privileges to edit other authors' entries, since your guest users, even if they have previously submitted entries, still belong to the "Guests" member group (because they have not logged-in).