It's a big strange that the viewing of the gcal event needs a filter_access check. How would any user actually use the selected input format to simply view the gcal events block?

This is a simple patch to remove the filter_access() call from the display function.

After removal of the filter_access check, the block will display to everyone with whatever input filter was selected without the need to check if they have editing access to that filter or not, which it should never care about.

CommentFileSizeAuthor
gcal.diff.txt660 bytesendiku
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

jdwfly’s picture

Status: Active » Needs work

I'm not sure why this check was in there, but it would seem to me that you are correct that the user viewing the page isn't inputting the data for the block. I'm good with removing it as I don't think it implicates any security issues.

jdwfly’s picture

Status: Needs work » Fixed

Removed this code from dev version.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.