It is possible for a user with appropriate permissions, to manually submit a (properly urlencoded) email address to invite/delete/<email>. invite_delete() does NO checking if the associated user is a registered one or not. Deletion should ONLY be possible if the user is still not registered (panding/expired invitation), or the appropriate permission has been given to delete registered users (code>invite_allow_join_delete variable). This patch adds the required permission checks.
--
Stefan Kudwien
www.unleashedmind.com

CommentFileSizeAuthor
invite_delete.patch804 bytessmk-ka

Comments

AjK’s picture

AjK commented

Hey, Stefan, I see you have a CVS account on Drupal already. Would you like to be a co-maintainer of the invite module?

smk-ka’s picture

smk-ka commented

Sure. I am currently working on a large scale community project, but I can spend some extra time here.

AjK’s picture

AjK commented

Hi, I've added you in. Not expecting anything big (unless you want to) just since you're an active developer it makes sense to just give you direct access to fix bugs as you see fit. Thanks :)

smk-ka’s picture

smk-ka commented
Status: Needs review » Fixed

Commited slightly changed version and backported to DRUPAL-4-7.

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)