Closed (duplicate)
Project:
Profile CSV
Version:
master
Component:
Code
Priority:
Critical
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
13 Sep 2006 at 16:52 UTC
Updated:
28 Sep 2006 at 04:58 UTC
I found and fixed few problems:
first - the module didn't generate any list, and secondly - the link to download the export is available to unprivileged users.
First problem:
easy to fix - just go over the queries in the module. Some of them miss the curly brackets which help drupal to prefix the tables in the queries. Just add them around the table names, and the list will be available.
Second problem:
there is a wrong 'access' definition in the hook_menu function, that permits downloading to users with the 'access users profile' privilege. Just change that to 'administer users' and the security improves at once (more of a privacy matter than a security one actually).
Comments
Comment #1
buddaYes, the mistake in the hook_menu() giving all users access to the export data is a bit of a big security vulnerability. As mentioned in the above comment, changing the permissions to user_access('administer users') should be done ASAP.
Comment #2
wafaa commentedFirst problem has been fixed some time back. The latest download should have it.
The second problem is a duplicate of http://drupal.org/node/83061