The call to user_access in the user edit page form alter function is not sending the user account to user_access. This means that if another user attempts edit another user, the 'approve comments on own xxx content' checkboxes reflect the permissions of the user doing the editing, not the user being edited. For example, if user 1 tries to edit another user's settings, a checkbox will appear for every content type instead of just the ones the given user has access to.

It's not a huge deal, but then neither is the fix:

if (user_access('approve comments on own ' . $node->type . ' content')) {

on line 186 should be:

if (user_access('approve comments on own ' . $node->type . ' content', $account )) {

Patch file attatched.

Hope this helps
Ronan

CommentFileSizeAuthor
usercomment-useraccess.patch803 bytesronan

Comments

gwen’s picture

Status: Needs review » Fixed

Thanks for the patch! I just put checked the changes into CVS.

Anonymous’s picture

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.