Hi there,
Looks like I've now purchased all of your modules and so I'm sure I'll be in here with a few suggestions in the next days or weeks. 
I pruchased the rotator because I was having trouble displaying zldnn's google map module inside mandeep's css tabs module. The map would break up somehow.
It works fine in digRotate however so that 's a great start!
Two things became immediately apparent.. so here they are for consideratin in a future update:
Can you provide the action menu module edit items as action buttons/links. This goes for all modules, not just this one. It is far easier for someone with module edit rights to see the text links than it is to find the solpart actions. In this module that would mean the "admin" menu item. The "Clear Rotate Cache" item is probably not as important.
And the other thing I've noted is that when I create a tab in the rotator and put a module inside it, the container (title, visiblity icon etc) for that module remains visible on the page outside of the tab.
In mandeep's version, the container moves into the tabs module along with the module it belongs to. The tabs module then has an option for hiding the container.
Obviously I can go and hide the container for the module, but that requires page dit permissions, which are a higher level of access than is required for managing content. Hising the container also means that any action buttons or menus it had would vanish for the person with module edit rights, thus placing the module content out of action.
hmm. I've also just now discovered a much more serious issue than anything above.
When I'm signed in as a content manager with only module edit rights, the module allows me to grab any module from any page on the portal, including from pages I do not have edit rights for. In the system here that means that a content manager can gain access to the accounts management module and elevate their own security status.
Is there anything you can do to inhibit this behaviour? Are you able to make it disallow exctraction of modules from pages where the user does not have page edit rights? Or if that isnt' possible, perhaps a host setting to only allow modules to be insterted from the same page the module is on... that would at least remove the issue and still let the module be used.
In fact, if the module-insertion settings defaulted to the current page, which it currently does not, then it would be easy enough to hide the page selection dropdown from non-admin roles. That would be a workable option if none of the above was possible.
Sorry for the rather long post... I tend to get into a lot of detail.. and there will no doubt be more to come :)
Regards,
Rob |