Textfields shouldn't use autocomplete for users without permission [#186001]

A project_issue user at my day job reported a bug where, as an anonymous user trying to use the advanced issue search page, they got a JS error box when they tried to use any of the autocomplete fields (submitted, assigned, participant). The reason is that user/autocomplete requires 'access user profiles' permission, yet project_issue happily makes all those fields auto-complete, even if the current user can't access user/autocomplete. Attached patch solves the problem by only turning those fields into auto-complete fields if the current user has access. Applies cleanly to DRUPAL-5, but also applies (with fuzz) on HEAD, DRUPAL-4-7--2 and DRUPAL-4-7. Tested and working nicely, both with and without 'access user profiles'. Any objections before I commit? ;)

Comment	File	Size	Author
	issue_search_autocomplete_access.patch.txt	1.7 KB	dww

Comments

Comment #1

hunmonk commented 24 October 2007 at 06:40

Title:	Advanced search shouldn't use autocomplete for users without permission	» Textfields shouldn't use autocomplete for users without permission
Project:	Project issue tracking	» Drupal core
Version:	5.x-1.x-dev	» 6.x-dev
Component:	User interface	» user.module
Status:	Needs review	» Needs work

actually, yeah -- i think i do have an objection :)

my feeling is that this should be properly fixed in core. i'm guessing the fix would be about as hard in core, and then modules wouldn't have to mess with it at all.

i'm *pretty* sure that fixing it in core won't cause any weird limitations or behaviors -- the user that got the form should be the same user that's making the autocomplete request, so it should be fine to do the access check somewhere in the autocomplete building code.

Comment #2

dww

we/he/they

commented 24 October 2007 at 08:33

Assigned:	dww	» Unassigned
Status:	Needs work	» Active

It's not clear in the D5 menu API how to find out if the current user can access a given path. _menu_item_is_accessible() is supposedly private to menu.inc, and operates on menu ids (mids). Do I have to call menu_get_item() and then use this private function directly? It's no doubt going to be vastly different in D6 menu land. *sigh*

If this is going to be a core bug dealing with different versions of FAPI and multiple menu systems, I'm afraid I don't have the time or energy to work on this. Furthermore, the existing patch is totally unrelated to the new strategy for solving this, so "active" would be more accurate...