Hi there,

I just happened to take a look at your module (it sounded interesting) and I noticed that it has two small permissions issues.

One is that there is no permissions check for the view op in recent_comments_block(), so even people without 'access comments' can view the block. The other (even smaller) issue is that there's an extraneous call to user_access() at the beginning of recent_comments_settings(). You've already got your call to user_access() in recent_comments_menu(); so while I don't think this extra call is really hurting anything, I don't think it's needed, either.

I've attached a patch that makes both changes.

Thanks!

CommentFileSizeAuthor
permissions.patch971 bytesvenutip

Comments

todd nienkerk’s picture

Assigned: Unassigned » todd nienkerk
Status: Needs review » Fixed

Fixed in 5.x-1.1. Thanks!

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.