I implemented some default links for new users, and quickly discovered that the links were shown, irrespective of the users permissions.

Should be easy to replicate. Grant access to a page and add the link. Remove access and the block shows all links, even the one that the user can no longer access.

Easy fix if your interested.

  // Process favorites.
  foreach ($raw_data as $favorite) {
    // Try to see if Drupal is restricting access to the path.
    if ($link = menu_get_item($favorite->path)) {
      if (!$link['access']) {
        continue;
      }
    }

Comments

Alan D. created an issue. See original summary.

alan d.’s picture

Status: Active » Needs review
StatusFileSize
new608 bytes

And a patch :)