Closed (duplicate)
Project:
Editable Fields
Version:
7.x-1.x-dev
Component:
Code
Priority:
Major
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
2 Jan 2012 at 18:52 UTC
Updated:
6 Oct 2012 at 11:48 UTC
I'm not sure the node permissions are being applied to editable fields?
Example:
For content type article, authenticated user role only has permission to edit own content. Content type article has an editable field.
User A creates an article node. User B can view the node and edit the field, even though he can't edit the node.
Comments
Comment #1
mr.h commentedThis is bad. I can also edit other user profiles
Comment #2
thechanceg commentedIt doesn't look like it has any kind of permissions check. I can actually edit content without being logged in?!
Comment #3
q2_faith commented+1
Comment #4
johnvDoes this help?
#1344634: Editing fields without update access (D7)
Comment #5
Taxoman commentedThere is a patch for review in #1344634: Editing fields without update access (D7)