Permission of the autocomplete callback path

Thanks a lot deruitern, actually I thought I had fixed that in #716794: Permission of the autocomplete callback path but it's not working ! I'd prefer to understand what happens in that other bug first...

It's more a feature request, since in general Realnames are intended to be public as stated by the Drupal security team. But I do understand your point.

Isn't it possible to fake that a field is requesting http://mysite.com/realname_userreference/autocomplete ? Otherwise your solution seems OK, but why doesn't it work with the permissions like I wrote in http://drupal.org/node/716794#comment-4090534 ?

Like in CCK Nodereference, I prefer to check the access in a dedicated function outside of realname_userreference_auto(), and I guess the permission checks are fine too. So I'm thinking of :

Modification :

/**
 * Implementation of hook_menu().
 */
function realname_userreference_menu() {
  $items = array();
  $items['realname_userreference/autocomplete'] = array(
    'title' => 'Realname Userreference autocomplete',
    'page callback' => 'realname_userreference_auto',
    'access callback' => 'realname_userreference_auto_access',
    'access arguments' => array(2),
    'type' => MENU_CALLBACK
  );
  return $items;
}

Add that :

/**
 * Check access to the menu callback of the autocomplete widget.
 *
 * Check for both 'edit' and 'view' access in the unlikely event
 * a user has edit but not view access.
 */
function realname_userreference_auto_access($field_name) {
  return user_access('access content') && ($field = content_fields($field_name)) && isset($field['field_name']) && content_access('view', $field) && content_access('edit', $field);
}

What do you think ? Thanks again for pointing and helping with that issue.

Discovering Git, I hope the patch is OK.

Good, I'll commit on monday and release 6.x-1.2 !