If a page is not published, comments are accessible in any case. It is serious vulnerability.

Comments

johnnoc’s picture

johnnoc
Primary language Norwegian Bokmål
Location Oslo
commented
Title: If a page is not published... » Does not respect user access
Assigned: B.X » Unassigned
Priority: Normal » Critical

I think that this issue is to be tagged critical because it handles on user access to pages.

IMO, it is sad... I love the module, but the access on comments is a huge deciding factor :-(

rszrama’s picture

rszrama commented
Component: Miscellaneous » Code
Status: Active » Fixed

Thanks for the report, and sorry for the sluggish update. This is now fixed as of the 1.1 version using the same access control Drupal uses when someone tries to view a node.

Anonymous’s picture

Anonymous (not verified) commented
Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.