It is very easy in Drupal to create a role with no name.
This should be caught; drupal should say "Sorry you must specify
a name before clicking on the "Add Role" button. The page where
this occurs is:
http:///admin/user

-rich

CommentFileSizeAuthor
#1 user.module_2.patch3.17 KBPrometheus6

Comments

Prometheus6’s picture

Assigned: Unassigned » Prometheus6
StatusFileSize
new3.17 KB

This happened because a switch statement in user_configure() allowed the "Add role" (and the "Save role", and "Delete role" cases) to drop through into the processing for the "role" case after setting the return message. The "role" case calls user_admin_role(), which executes the SQL and draws the role overview and such.

The patch seperates the creation of the overview form into its own function so the form can be drawn without processing any SQL. It also changes the user_configure() switch statement so the Add, Save and Delete role cases don't drop through to the role case.

dries’s picture

I committed an alternative fix to DRUPAL-4-5 and HEAD.

Anonymous’s picture