The autologout AHAH callbacks require the "access content" permission and I submit that there is no need for this. Lets say I create a role called "user moderator" ... the only permission that user might have is "create user" (or whatever). What does access content have to do with auto logging out?

The attached patch removes the access callback function

CommentFileSizeAuthor
#1 autologout-perms.patch1.01 KBbleen
autologout-perm.patch622 bytesbleen
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

bleen’s picture

FileSize
1.01 KB

This is a better patch as it does check for logged in users

johnennew’s picture

Status: Needs review » Fixed

I agree! Patch committed.

johnennew’s picture

Added backport to 6.x-4.x branch.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

  • Commit 295e96c on 7.x-4.x, 8.x-1.x authored by bleen18, committed by ceng:
    Issue #1715674 by bleen18: No need for access content permission in ajax...