I found and fixed few problems:
first - the module didn't generate any list, and secondly - the link to download the export is available to unprivileged users.

First problem:
easy to fix - just go over the queries in the module. Some of them miss the curly brackets which help drupal to prefix the tables in the queries. Just add them around the table names, and the list will be available.

Second problem:
there is a wrong 'access' definition in the hook_menu function, that permits downloading to users with the 'access users profile' privilege. Just change that to 'administer users' and the security improves at once (more of a privacy matter than a security one actually).

Comments

budda’s picture

Version: 4.6.x-1.x-dev » master

Yes, the mistake in the hook_menu() giving all users access to the export data is a bit of a big security vulnerability. As mentioned in the above comment, changing the permissions to user_access('administer users') should be done ASAP.

wafaa’s picture

Status: Active » Closed (duplicate)

First problem has been fixed some time back. The latest download should have it.

The second problem is a duplicate of http://drupal.org/node/83061