when i first wrote the code for hook_user_operations, i unfortunately neglected to realize that the role assignment shortcuts should only be available to users w/ the 'administer access control' permission. thus currently anybody w/ 'administer users' permissions can assign themselves any role and gain unauthorized access to other areas of the site. not good...

attached patch corrects this.

tested and working well on a clean current HEAD.

CommentFileSizeAuthor
#1 user_op_0.patch2.73 KBhunmonk
user_op.patch2.75 KBhunmonk

Comments

hunmonk’s picture

hunmonk commented
StatusFileSize
new user_op_0.patch2.73 KB

chx suggested a += instead of an array_merge.

once again tested and working fine on a clean HEAD

chx’s picture

chx commented
Status: Needs review » Reviewed & tested by the community
dries’s picture

dries commented
Status: Reviewed & tested by the community » Fixed

Committed to CVS HEAD. Thanks.

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)