Hi all,
I noticed that users who have the ability to access their own broken links are also able to see other user's broken links. These users do not have "access broken links report" permission or "administer linkchecker". They simply have view their own broken link. I noticed the problem on 2.4 and upgraded to dev thinking that might fix the problem. It did not

All the best,
Patrick

Comments

hass’s picture

Status: Active » Postponed (maintainer needs more info)

The second user may have edited the article or created a new revision or have used the same link in one of his articles, too. What give you the impression that something goes wrong?

flahertypj’s picture

Thanks for your response. I created a brand new account. The account has never edited any article but it's able to see any and all broken links by all users.

(Sorry about the delay in responding. I've been traveling)

All the best,
Patrick

hass’s picture

Category: bug » support

The user must be member of a role that have this permission. Not sure under what url you look for the broken links. Would be good to know

flahertypj’s picture

I've given all authenticated user permission to access own broken links report. Users with that permission can go to any users account and see the tab for broken links and then see the page with the broken links. This must mean that tab and page generation isn't checking the permission correctly.

I'll look at the code sometime today and see if I can figure out the problem.

Thanks

flahertypj’s picture

I believe the menu item was missing 'access callback'. I added it along with a linkchecker_access_callback function and it seems to have fixed the problem.

@@ -93,7 +93,8 @@
     'page callback' => 'linkchecker_user_report_page',
     'page arguments' => array(1),
     'type' => MENU_LOCAL_TASK,
-    'access arguments' => array('access own broken links report'),
+    'access callback' => 'linkchecker_access_callback',
+    'access arguments' => array('access own broken links report', 1),
     'file' => 'includes/linkchecker.pages.inc',
     'weight' => 3,
   );
@@ -109,6 +110,9 @@
   return $items;
 }
 
+function linkchecker_access_callback($permission, $account) {
+  return ($account->uid == $GLOBALS['user']->uid && user_access($permission));
+}
 /**
  * Implementation of hook_cron().
  */
hass’s picture

Category: support » bug
Status: Postponed (maintainer needs more info) » Fixed

Fixed in D6/D7

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.