If you allow users who aren't logged in post images then the permissions checking allows any other user also not logged in edit it.

I've added a perm 'edit own images' and added to the access check - same as stories.module

Very simple patch made on 4.7.0 works on cvs too - there is a copy for 4.6.0 on http://docs.indymedia.org/view/Devel/ImcDrupalDev#Downloads

CommentFileSizeAuthor
#1 image.module.20060523.patch.txt753 bytesekes
image-4.7.0.module.patch.txt469 bytesekes

Comments

ekes’s picture

ekes commented
StatusFileSize
new image.module.20060523.patch.txt753 bytes

Patch with all the descriptive stuff attached

ekes’s picture

ekes commented

Same problem (same auth code) patched and fixed in Audio http://drupal.org/node/64889

jraper@groups.drupal.org’s picture

jraper@groups.drupal.org commented

Sorry if this is a dumb question -- Would I be correct in assuming that this patch will only be operative while the original anonymous user's session is in force. If so, is the image effectively "locked" to all anonymous users (including the originator) thereafter? Just trying to understand this change's implications.

ekes’s picture

ekes commented

Yes, well if you don't want anonymous users (read anyone) to be able to edit posts made anonymously then if someone makes a post anonymousiy they won't be able to edit it. This is normal behaviour for Drupal modules - see story for example.

I don't think this bug effects many people, as they don't allow anonymous image posting... but some of us do. So for us please make the fuction of image consistent with other modules - above does it :-)

allie micka’s picture

allie micka
she/her
commented
Priority: Normal » Critical
Status: Needs review » Reviewed & tested by the community

I'm making this "critical" because it opens a rather significant security hole when you delete a user and her content is set to uid=0. All images created by the deleted user become world-writeable. Which is bad.

RTBC.

Thanks!

walkah’s picture

walkah commented
Title: Anonymous users can edit anonymously posted images » Anonymous users can edit anonymously posted images
Status: Reviewed & tested by the community » Fixed

committed. thanks!

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)