Posted by Zen on September 24, 2008 at 4:23pm
Jump to:
| Project: | xapian |
| Version: | 5.x-1.x-dev |
| Component: | Code |
| Category: | task |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | closed (fixed) |
Issue Summary
FYI: Not sure what the status of this module is, but I have access to its configuration page. My role shouldn't.
Comments
#1
This isn't exactly a security issue, but the public queue probably isn't the best place to report this either...
You have the "CVS Admin" role on d.o which has the permission "access administration pages".
The xapian module uses this code for the menu callback:
'access' => user_access('access administration pages'),Maybe something like
'access' => user_access('access administration pages') && user_acces('administer search'),would be better?
#2
Thanks! Fix committed. (I switched from 'access administration pages' to 'administer search', which is the same permission used by the core search module.)
#3
Automatically closed -- issue fixed for two weeks with no activity.