Later cousin of http://drupal.org/node/27864 for 4.6.2

To reproduce:
- Take a page which is denied to anonymous users by node_privacy_byrole
- Go to it as an anonymous user
- Receive 404 error

cvs shares the same code for both the view and edit ops, so a slightly larger patch

CommentFileSizeAuthor
#3 27873-node.module-cvs_0.patch977 byteswillmoy
#1 27873-node.module-cvs.patch977 byteswillmoy

Comments

willmoy’s picture

willmoy commented
StatusFileSize
new 27873-node.module-cvs.patch977 bytes

patch attached

dries’s picture

dries commented
Status: Needs review » Needs work

That code is insecure and may lead to SQL injection attacks.

willmoy’s picture

willmoy commented
Status: Needs work » Needs review
StatusFileSize
new 27873-node.module-cvs_0.patch977 bytes

This patch updated as the 4.6.2 one was.

Steven’s picture

Steven commented
Status: Needs review » Fixed

Committed. Please submit only a issue next time, with multiple attachements.

Anonymous’s picture

(not verified) commented
Anonymous’s picture

(not verified) commented
Anonymous’s picture

(not verified) commented
Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)