First and foremost : Great module!

Though the description says "Respects Drupal permissions' system (block restricted to certain roles aren't rendered for others)", I'm afraid it doesn't seem to work.

For me, any block that is addedd to the home box page is displayed whatever permission.

CommentFileSizeAuthor
#3 block_level_permission.diff1.36 KBjchatard

Comments

jchatard’s picture

Can you please try with 1.0 stable version?

And if this persists, can give some more details about the kind of permissions you set so I can reproduce your config?

Thanks,
Jérémy

eme’s picture

Version: 6.x-1.0-beta1 » 6.x-1.0

Actually my mistake : I am already using 1.0 stable version.

I set very simple permission : I create a block with permission for a role only. And when I connect with a user that does not have this role, he sees the block. I checked of course by putting the block in the sidebar, and it works normally (i.e. the user do not see the block in the sidebar but sees it in the homebox).

jchatard’s picture

Status: Active » Needs review
StatusFileSize
new1.36 KB

Damned!

You're right eme!

Here's a patch that should correct this huge security bug!

Could you please test it under your configuration and let me know. If every thing is ok I'll put a security release.

Thanks for pointing out this!
Jérémy

jchatard’s picture

Priority: Normal » Critical

Changed priority to critical

eme’s picture

After the first tests, it seems it works well now for roles permissions.

It could be interesting to precise in the README or wherever that it works only with role permissions (and not with complex PHP permissions). Some people coud try to use the PHP to show homebox only in specific cases (like having two diffent roles at once).

It could be an interesting feature request to make this functionality, but I'm not sure it's "the" great feature. Only the PHP code validation is of interest of course, as the two other visibility choices (the per page choices) are of no use since HomBox has its own administration page to activate/desactivate.

jchatard’s picture

Status: Needs review » Fixed

in 6.x1.1

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.