Access to (un)flagging pages is controled by 'access content' permission

What I've found is that if 'view published content' isn't checked for a particular role, that role will get 403 when trying to use flags. I'm running into the same issue, though mine is a flag using the User entity. I was hoping 'view published content' wouldn't be necessary as it doesn't involve content, only users.

My usage for flag is to have essentially a user in a restricted role (not able to view published content) be able to flag another user as 'request a sponsor'. The user they flagged gets a notification of a Sponsor Request and then flags them back under another 'Sponsor this user' flag. This triggers escalation of roles so that the user can 'view published content'.

Maybe the developer could comment on this?

Workaround is to keep 'view published content' checked for that role, and instead use https://www.drupal.org/project/node_view_permissions to limit viewing permissions for every content type individually.

Confirming this.

The problem is that the paths for flagging don't take this possibility into account:

  $items['flag/%/%flag/%'] = array(
    'title' => 'Flag',
    'page callback' => 'flag_page',
    'page arguments' => array(1, 2, 3),
    'access callback' => 'user_access',
    'access arguments' => array('access content'),
    'file' => 'includes/flag.pages.inc',
    'type' => MENU_CALLBACK,
  );

Here's a patch. Let's see what the testbot says.

Testbot happy, so let's go with this.