The form, _poll_choice_form(), adds a textfield for vote counts on the add/edit form for poll nodes. This field is only displayed for users with the "administer nodes" permission.

  $form['chvotes'] = array(
    '#type' => 'textfield',
    '#title' => t('Votes for choice @n', array('@n' => ($delta + 1))),
    '#default_value' => $votes,
    '#size' => 5,
    '#maxlength' => 7,
    '#parents' => array('choice', $delta, 'chvotes'),
    '#access' => user_access('administer nodes'),
  );

Within the theme callback to theme for form, theme_poll_choices(), the table to show all of the poll choices contains a header for "Vote count" as well as attempts to render the vote count field; without any check for the "administer nodes" permission. So, if you're not an admin, you see the "Vote count" table header, and empty cells (see attached).

Permissions should be checked in the theme function to avoid showing this column. Or, the form should return uneditable numeric values if you're not an admin.

Patch coming for both solutions.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

mstef’s picture

Both patches attached. The first patch shows the vote values as a simple number, the second hides them and the column completely (only for non-admins).

mstef’s picture

Status: Active » Needs review
sheld0r’s picture

Status: Active » Needs review
sheld0r’s picture

Status: Needs review » Closed (outdated)

Automatically closed because Drupal 6 is no longer supported. If the issue verifiably applies to later versions, please reopen with details and update the version.