Add check for permission before displaying location

I didn't write nor do I support the location integration code. Since this has never come up before, it's possible the permission didn't exist when it was added. If someone wants to submit a patch for permission checking, I'd be happy to add it. Otherwise, people either need to edit their template or remove the .inc. If it becomes a major issue and no one comes forward with a patch, I will remove the integration from the module.

Michelle

I have to agree with the OP and #1: to expose location information without honoring permissions is a significant security breach. Regardless of who wrote or currently supports the location code, to expose it by default is not a good idea. I suggest making this disabled by default but offering an option to enable it.

Or, a nice compromise would be to partially enable it. For example, by default just the user's Country and City could be shown. To show more would require template editing.

(Also, I confirm that removing author_pane/modules/location.author-pane.inc is a quick fix until the next version).

I think you missed the point that no one is supporting it and so far that's who's offered up a patch as well.

Michelle

This was unpublished since it went to the security team but, for those who have permission to read it, this has been resolved by removing the location integration.

Michelle

This likely should have been reported confidentially.

Since there are no supported versions of this project currently, it can be handled in public. It looks like it was fixed.