The extensions list appears regardless of being admin or not. if you give this right, a malicious user can change extension type to vbs and upload viruses.

Comments

junyor’s picture

junyor commented
Status: Active » Closed (duplicate)

Duplicate of http://drupal.org/node/133950.