Hi there....

I'm using mass contact as to be the only one as admin to send email to all users...
But if a logged in user goes to site.com/node/add they see a link to add a mass_contact node.
Is this intentional?, None what so ever have any permissions to mass_contact at all
Im also using content access module and there ive unticked all acces to mass_contact nodes also...

Comments

oadaeh’s picture

oadaeh commented
Component: Miscellaneous » User interface
Category: bug » support
Status: Active » Closed (works as designed)

Look for the "Mass Contact message: Create new content" permission in admin/people/permissions and disable that item. That is how that item shows up in the menu and how people are given permission to access the page.

Drupal creates the link and permission (because that's the way it works), but is disabled by default.

You don't need that permission enabled for Mass Contact to work correctly.

acoustika’s picture

acoustika commented

Well as I stated they are unticked...... Im very aware of the permisssions on my site, everything is unticked except the few things ppl need to be able to do

I have 2 custom roles, but all even administrator is unticked for the mass_contact module....

Just checked and even an anonymous user will enter the node/add for mass contact if they do a url like mysite.com/node/add

oadaeh’s picture

oadaeh commented

I, as an anonymous user, get "Access denied" when going to node/add. As either UID 0 or 1, I get the same page when going to node/add/mass-contact.

You have something else going on your site that is allowing you to access those pages.

acoustika’s picture

acoustika commented

Well..... Must be a clash between some other module then.... As I wrote I have the content access module installed also but in there Everything is also unticked so I can't image what it is....

Other permission modules I have is nodelimit but only one rule in there to limit a whole different node type...
So can't imagine what it could be....

But not so critical for me since I stopped it in my custom module..... Just better if it were working correct....

if( arg(0) == 'node' && arg(1) == 'add' && (arg(2) == '' || arg(2) == 'mass-contact') ) {
     drupal_goto("404");

Must be a clash with some module

acoustika’s picture

acoustika commented

Well, actually I started disabling modules on my dev site one by one and it turns out it IS nodelimit that clashes with mass_contact...
Just in case you wanna look into it, Nothing I have the skills to do, specificly is the Node Limit Type module thats giving access for all user to mass_contact form....

sillygwailo’s picture

sillygwailo
Location Toronto, ON
commented
Issue summary: View changes
Related issues: +#1422090: Anonymous users can create nodes no matter what...