Form _submit and _validate callbacks should not call user_access() checks. Doing so interferes with form processing and can break hook_form_alter().

aggregator_categorize_items() is only called by _aggregator_page_list(), which only loads the form if the permission check passes.

CommentFileSizeAuthor
#1 687578-aggregator.patch2 KBagentrickard
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

agentrickard’s picture

Status: Active » Needs review
FileSize
2 KB

And a patch.

Dave Reid’s picture

Status: Needs review » Reviewed & tested by the community

Confirmed. This makes a lot of sense since this form will never be displayed if the user doesn't have this permission.

Dries’s picture

Status: Reviewed & tested by the community » Fixed

Committed to CVS HEAD. Thanks.

Status: Fixed » Closed (fixed)
Issue tags: -D7DX, -forms api

Automatically closed -- issue fixed for 2 weeks with no activity.