Users can administer the Themer module without having permission to do so.

Comments

renenee’s picture

I am getting the same result. Any help available?

* Module is enabled
* "administer themer" is not selected for authenticated user
* Authenticated user is still able to access Themer

renenee’s picture

Otherwise, a very useful module, by the way!

markwittens’s picture

I had the same problem, the solution is pretty simple:

1. Open themer.module
2. Goto the themer_menu function, the code there is:

  $items['admin/settings/themer'] = array(
      'title' => 'Themer',
      'page callback' => 'drupal_get_form',
      'page arguments' => array('themer_settings'),
      'access callback' => 'user_access',
      'access arguments' => array('access content'),
      'type' => MENU_NORMAL_ITEM,
    );  

This should be:

  $items['admin/settings/themer'] = array(
      'title' => 'Themer',
      'page callback' => 'drupal_get_form',
      'page arguments' => array('themer_settings'),
      'access callback' => 'user_access',
      'access arguments' => array('administer themer'),
      'type' => MENU_NORMAL_ITEM,
    );  

Notice how 'access arguments' has changed so the proper permissions are used.