When module better formats is enabled the pingback setting "Hide pingback input format for anonymous users" does not have an effect (better format seems to override that). So anonymous users can post comments with pingback input format.

Cheers, Ronald

Comments

rokr’s picture

rokr
Location Bochum, Germany
commented

Maybe this issue will be solved when better formats issue #376207: Disallow input formats for comments has landed.

kars-t’s picture

kars-t commented

A workaround is to remove the right added by better formats to choose the input format from the anonymous group.
Normally the anonymous user uses something like filtered html and thats it. If they really should be able to choose input formats add a good description why not to use the pingback format ;)

Freso’s picture

Freso commented
Status: Active » Closed (works as designed)

I don't think we should go and take into account how other contrib modules might or might not alter Drupal's forms. The option hides it using standard Drupal FormAPI functionality, and if another module overrides this, there is little we can do, apart from manually checking whether that module exists... but then that could go on and on...

Try and set Pingback's module weight to be heavier (and thus be called later) than Better formats' weight? Or simply see if there isn't an option in BF to hide the Pingback input format.

And you shouldn't use the pingback input format, as it may be given fewer security restrictions (on HTML etc.) than what might normally be provided for anonymous users.