theme_boxes_box() exposes 'edit' and 'cancel' links regardless of the user's permissions. Clicking on the 'edit' link as a user with insufficient permissions results in an ajax error (js popup).

Patch coming.

CommentFileSizeAuthor
#1 859750-1_protect_controls.patch2.37 KBalex_b

Comments

alex_b’s picture

alex_b commented
Assigned: alex_b » Unassigned
Status: Active » Needs review
StatusFileSize
new 859750-1_protect_controls.patch2.37 KB
jmiccolis’s picture

jmiccolis commented
Status: Needs review » Fixed

Committed, with one change; using boxes_access_admin() to check permissions instead of going after "administer blocks" directly. This way we keep spaces happy.

Thanks for the patch!

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.