Chatbox logs can be seen without permission [#70724]

The turning off of the setting "view chatbox log" in the Access Control page for the chatbox.module only stops Drupal from displaying the link to the logs. Anybody (non-authorized members, non-members, everybody!) can access the logs if they know the right url, which is the same for all Drupal sites using this chatbox.

Comment	File	Size	Author
#4	chatbox-logaccess.patch	651 bytes	darren oh
#3	chatbox2.patch	211 bytes	jmengle
#1	chatbox_0.patch	526 bytes	jmengle

Comments

Comment #1

jmengle commented 20 July 2006 at 17:49

Status:

Active

» Needs review

Status	File	Size
new	chatbox_0.patch	526 bytes

I added a user_access check before the logs were shown, and it seems to work. This is my first patch; be gentle ;)

Comment #2

ricmadeira commented 24 July 2006 at 01:29

Thanks! That does the trick, alright!

I don't understand much about this too, but shouldn't the "You are not authorized" message be inside a "t()" so that Drupal can translate it in other languages too? Otherwise, everything seems fine!