Currently the "more help" links are displayed even if the user doesn't have access to view them.

I hope this will be fixed because I think it's a bug to display links that cannot be followed.

Attached patch adds check against user_access("access administration pages") which is the same permission used by help.module prior to displaying the help pages.

CommentFileSizeAuthor
#3 help_access_check-137112.patch823 bytesAmrMostafa
#2 menu.inc_20071029.patch826 bytesstevenpatz
help_pages_access_check.patch731 bytesAmrMostafa

Comments

catch’s picture

catch
he/him
Primary language English
commented
Status: Needs review » Needs work

No longer applies.

stevenpatz’s picture

stevenpatz
he/him
commented
Status: Needs work » Needs review
StatusFileSize
new menu.inc_20071029.patch826 bytes

here's an updated patch.

AmrMostafa’s picture

AmrMostafa commented
Version: 6.x-dev » 7.x-dev
StatusFileSize
new help_access_check-137112.patch823 bytes

Rerolled for HEAD.

cburschka’s picture

cburschka
they
commented
Status: Needs review » Reviewed & tested by the community

Simple enough...

dries’s picture

dries commented
Status: Reviewed & tested by the community » Needs work

It looks like we can remove && $help from the if-test by moving that if statement into the if-statement above (i.e. nesting).

It also looks like arg[0] == "admin" might be redundant, especially with that new check?

We could also consider to move user_access('access administration pages') && module_exists('help') outside of the foreach-loop.

More importantly, I'm puzzled about how someone can see those links if they don't have the 'access administration pages' permission. As far as I can tell, these links are only generated on administration pages. In other words, they shouldn't have access to the page with the link to begin with?

Mac Clemmens’s picture

Mac Clemmens commented

Hey Dries,
It is possible to see the the help links on some administrative pages, such as /admin/content/forum, which do not require "access administration pages". Users will see an access denied error when clicking through on the "more help" link (which links to admin/help/forum). Hope this helps!

s.shayda’s picture

s.shayda commented
Issue summary: View changes
Priority: Normal » Minor
Status: Needs work » Needs review
Related issues: +#678628: Remove "More Help"

Hello!

This ticket can be closed. This bug was fixed by commit "e1812b33 Angie Byron on 2010-01-12 at 08:09"
in ticket https://www.drupal.org/node/678628

poker10’s picture

poker10 commented
Status: Needs review » Closed (outdated)

Closing according to the #7. The respective commit is here: https://git.drupalcode.org/project/drupal/-/commit/e1812b3353b6fe735e9a0dacf7e48b6eeb71d4cd