Permission to post on others status

Quick patch attached solves it in form, but should be reviewed the submit (nodeapi) code also to protect from malicious POSTs from anyone who knows account_id of other users.

HI.
in 7.x-5.8 has the same problem, there is a solution?

this definitely deserves some work…

This is definitely a big issue if twitter post can post form any twitter account authenticated to the website.

There used to be a concept of a global/sitewide twitter account at some time which has since been removed.

Ideally the sitewide account should also be useable along with the own account, but definitely no other accounts.

Re-rolled patch against latest dev.

Oops wrong variable. Re-rolling.

Created a similar patch for the 6.x branch. This adds a global account field to the admin settings form so that given Twitter accounts are available globally.

Rerolled.

Could someone please test this - it adds protection via hook_node_insert().

This also checks if the account is global.

Backported to 6.x-5.x.

Rerolled for 7.x-6.x. I'm not sure if this is correct - the field-based structure works differently to the structure from 7.x-5.x and it may need some adjusting. In particular, the field stores the twitter account's Drupal uid whereas the old method stores the actual Twitter ID.

Trying that last patch again.

It turns out that this depends upon a feature that isn't actually exposed through the UI, so it's going to have to absorb #1935956: How to add a global account in 7.x-5.5?.

Back to the 7.x-5.x branch while I work this out.

Updated to also show the 'is_global' option on the twitter accounts list.

Updated patch for the 7.x-6.x branch.

Updated patch for the 6.x-5.x branch.

Committed.

Whoops, had some incorrect logic in twitter_post_node_insert().

Ok, corrected^2.

The fix ported to the 7.x-6.x branch.

The fix ported to 6.x-5.x.

Gah, trying to get the 7.x-6.x patch to apply correctly.

Not sure what it's problem is, it applies fine locally.

Committed.