When I unpublish a node, the nodewords for that node are rendered to the "access denied" message...

this could reveal some sensitive information sometimes and is definately not the expected behaviour.

Comments

Robrecht Jacques’s picture

Robrecht Jacques commented
Priority: Normal » Critical

True. Didn't think of that. Setting it as "critical".

Fixed in 4.7 : the 'view' permission for nodes is checked before showing node specific keywords. The meta tags will still include global copyright, global keywords, global robots, etc, but for example there should not be a description nor should the keywords assigned to the node itself appear.

Leaving this open because I need to fix it still in 4.6 and CVS. But it is now fixed in 4.7 (nodewords.module version 1.32.2.6).

Please test and report back if it still shows sensitive information.

Christoph C. Cemper’s picture

Christoph C. Cemper commented

wow - that was quick... will perform a test ASAP

Robrecht Jacques’s picture

Robrecht Jacques commented
Assigned: Unassigned » Robrecht Jacques
Status: Active » Fixed

Have you tested this?

I'm setting this to "fixed". If it is not the case, please reopen it.

Christoph C. Cemper’s picture

Christoph C. Cemper commented

Robrecht - I wanted to test this, but i have the strange effect that an anon user here
see's unpublished nodes as well, just as if he would be admin...

any clue why that could be?

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)