I've discovered that anonymous users could access the directories (Filebrowser pages) when using "dev" version 2011-06-20. Switched to 6.x.2.0-rc13 and problem solved. Cannot give you hints on previous developer versions as the computer with those older files broke, sorry. We are using Drupal 6.22, PHP 5.3.6 and for accesses the module "node privacy byrole".
Will keep an eye in future changes, Regards, Luis

Comments

lvadillo’s picture

lvadillo commented
Issue summary: View changes

minor cosmetical changes

Nicolas Georget’s picture

Nicolas Georget commented
Status: Active » Fixed

Again, PHP moves in mysterious ways :( Anyway, here's the trick:
In the file file browser.module, line 463:

if ($op == 'view') {
  if (user_access(FILEBROWSER_VIEW_DIRECTORY_LISTINGS, $account)) {
    return TRUE;
  }
}

You have to change line 464 & 465 (the exclamation mark before the fn user_access, and must return false):

if ($op == 'view') {
  if (!user_access(FILEBROWSER_VIEW_DIRECTORY_LISTINGS, $account)) {
    return FALSE;
  }
}

Yoran, if you hear my voice, can you explain that ??
Don't get it. user_access() return TRUE if "view directory listings" is granted. and if it's TRUE, the access callback for the $operation 'view' is true. So how can it be the inverse ?? i mean if the condition is != 0, so it's true or 1 !!

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

Anonymous’s picture

(not verified) commented
Issue summary: View changes

minor cosmetic changes