An authenticated user can still access the feed-page at node/x/aggregator from any group if he only knows the nid of the group.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | og_aggregator_access_20091111.patch | 388 bytes | geoffreyr |
An authenticated user can still access the feed-page at node/x/aggregator from any group if he only knows the nid of the group.
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | og_aggregator_access_20091111.patch | 388 bytes | geoffreyr |
Comments
Comment #1
Tim_O commentedSubscribing - and thanx for taking this to a new issue. I assume my analysis at http://drupal.org/node/611404#comment-2243932 was wrong, as you don't mention it here? Or was that part clear anyways to anyone else than me? ;)
Then: more questions, if you have the patience. Why version 6.x-1.x-dev and not 6.x-1.3? And finally I still see this as critical, but you know that so I am not going to overrule your judgement here. But would like to learn how to use Priorities correctly.
Comment #2
geoffreyr commentedJust a small patch, but it should ensure that viewing the feed page is checked against the viewing permissions of the group first.
Comment #3
Tim_O commentedThx, I successfully applied that patch on my testsite against 6.x-1.3 and can confirm that access is checked on the feed-site then. Cannot judge on code-level though, as I don't understand enough of it, yet.
Comment #4
Taz commentedThanks for the patch Geoff
Committed and a new release 1.4 has been made with these past few bug fixes.