Might be useful to add a check to ensure that anonymous users aren't granted any permissions whose names match, for example, the following regex: "(access all|add|administer|change|clear|create|delete|edit|post|revert|save|send mail|set variable|update|upload|without approval|PHP)"

Comments

malc0mn’s picture

malc0mn commented
Status: Active » Fixed

There will probably be some discussion to come as to what permissions the anonymous user should and should not have.

I have omitted the 'post' and 'without approval' parts from the proposed regex, as there are many situations where the anonymous user is allowed to post comments without approval. Besides, Mollom is free :-pp

Available in 6.x dev branch from CVS only.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

malc0mn’s picture

malc0mn commented

Now avaliable in the beta9 release.