[Building Sakai] NeoPortal dropdown tools not honoring permissions

[Steve Swinsburg]

IMO what you see should be what you can access. So the data should return the correct list. 

Cheers
Steve

Sent from my iPhone

On 10/05/2013, at 23:21, "Kusnetz, Jeremy" <JKusnetz at APUS.EDU> wrote:

> We make extensive use of functions.required to give instructors and students a different set of tools in our instance.
>  
> We found that the list of tools in the dropdown are just all the tools in the site, regardless of what the user should be seeing.  I found JIRA SAK-22982 but it doesn’t look like any work has started on it yet.  In my opinion this is a pretty major bug.  While clicking on a tool you aren’t supposed to have access to doesn’t actually go to that tool, it’s still a very confusing experience for the user to see tools that they shouldn’t.
>  
> Now it looks like the tool dropdown is driven by the site REST service (/direct/site/SITE_ID/pages.json).  It appears that this service isn’t honoring user permissions, and instead is just displaying all the pages in the site.
>  
> We are looking to see if we can fix this problem, but my question to the community is, what is the more correct thing to do?  Is the more correct thing to not return any pages/tools that the user shouldn’t see?  Or should the JSON contain other variables like functions.required that then can be looked up against the /direct/site/SITE_ID/userPerms.json REST service via the neoportal javascript?
> This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.
> 
> _______________________________________________
> sakai-dev mailing list
> sakai-dev at collab.sakaiproject.org
> http://collab.sakaiproject.org/mailman/listinfo/sakai-dev
> 
> TO UNSUBSCRIBE: send email to sakai-dev-unsubscribe at collab.sakaiproject.org with a subject of "unsubscribe"
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://collab.sakaiproject.org/pipermail/sakai-dev/attachments/20130511/207eed0d/attachment.html