Posted by Amitaibu on August 3, 2009 at 4:29pm
3 followers
| Project: | Content Construction Kit (CCK) |
| Version: | 6.x-2.x-dev |
| Component: | General |
| Category: | bug report |
| Priority: | normal |
| Assigned: | Amitaibu |
| Status: | closed (fixed) |
Issue Summary
A user without privileges to view a field, may see the content of a field via diff.
Comments
#1
This is actually a CCK issue.
(p.s. please add diff to CCK component).
#2
And here's the patch.
#3
Curiously enough I reported this issue to the Drupal security team a week or so ago. They concluded it could be resolved in the CCK queue and no additional action would be needed. In the meantime, I was discussing with yched and KarenS what to do next...
@Amitaibu: your patch is not correct as CCK provides a function for this: content_access().
Attached is the patch that will be committed to CVS, and I guess it will happen asap.
#4
Thanks, indeed, only after submitting the patch I realized it might be a security issue. Anyway, thanks for the re-roll.
#5
Committed to CVS (branches CCK2 and CCK3).
Soon to be released as CCK 2.5.
#6
Automatically closed -- issue fixed for 2 weeks with no activity.