CSRF security vulnerability and duplicate module

Subscribe. And agree.

Agreed. The module description screams "I'm insecure".

(typo)

Thank you for noticing that security issue, I will fix that as soon as possible

I think if somebody just needs to unpublish content easily from anywhere (view, block..etc), then this module presents a fast and easy way to do that,

I have not tried the fast toggle module but it sounds more complicated to put the links anywhere on the site than this module

It is more complicated, but that's part of the point...csrf requires some complexity to protect against it...

I will fix that issue and keep the simplicity intact

Should be fixed in the latest release

Marked the release as a security update to be properly reviewed by the drupal security team before publishing

The security team does not provide reviews for people. That flag is not meant to be used to request a review (did you read the instructions about how to use it? based on your comments I don't think so).

I've deleted the release given the fact that it was created somewhat inappropriately. I suggest you spend some time with just a dev release of this module before making a 1.0 release. You can delete the tag you created (see the cvs docs for details)

If you feel a 1.0 release of the current code tagged as 1.0 is more appropriate please simply recreate the release with the security update tag.

Thanks, I have created a regular release without tagging it a security update since it was never released before,

I have done some testing on the module and it works OK, so I decided it was ready for release

Its very difficult for a user to use the fasttoggle module to place a link in a view or a block to unpublish a specific node, because it uses ajax url and tokens to validate the action, just a link for whatever purpose he needs,

I have read on the issue queue that fasttoggle does not have views 2 support either, which makes it very hard for regular users to add links to unpublish nodes is a field based view,

And also there is no support for non node views as well, so if you needed to create a view that lists users and some of their nodes with an unpublish link you wont be able to,

I think these reasons justify the existence of the url_unpublish module,

What do you think?

No you misunderstood what I meant,

I meant that this module provides a simple url that you can place in a custom views field, custom block...etc,

I did not mean by user views to block users, I meant if you needed to create a user view for whatever reason and needed to relate the view to some nodes and needed a link associated with each node to unpublish it,

the way that fasttoggle works right now forces the maintainer to implement the views api to add a field to unpublish nodes, which can be accomplished very easily by this module using a custom field with a url,

Also the usage of links in blocks,

Basically allowing users to easily and simply put a link to unpublish any content in any place they need without any restrictions,

I believe the simplicity of accomplishing a task is very important,

In addition to fasttoggle, this functionality can be granted with the flag module. In fact, I always use flag for this functionality on my sites. Create a new flag, associate roles of who can use that flag, and attach the unpublish action to the flag. You can then add the flag as a field to views. You'd then also get the benefit of an ajax toggle.

If you really want users to be able to create a custom link to be able to insert anywhere, this module could instead be an input filter for flag allowing appropriately permissioned users the ability to arbitrarily insert flag links in text.

I agree with you that it can be accomplished using the flag module, but its not a straight forward method and requires an understanding of actions and not what the module was meant to do, its a clever usage of both actions and the capabilities of the flag module

However, if a regular user is trying to find a way to unpublish nodes using a url placed in a custom place he needs, its very hard for him to figure out that the flag module when combined with actions can generate a url that will accomplish that, dont you think?

This module was developed to simplify a task that shouldn't be that hard to figure out how to accomplish in Drupal,

However, I like your idea of an input filter for flag and will definitely give it a thought

I think it would be a good idea to add a new permission called "unpublish own nodes" which only allows the user to unpublish nodes that they have authored. It seems like a very quick change.

By the way, I've now documented how to protect against csrf http://crackingdrupal.com/blog/greggles/protecting-your-drupal-module-ag...

It looks like this was fixed in http://drupalcode.org/project/url_unpublish.git/commitdiff/e6a4ddb?hp=bb...