There is some inconsistency in displaying pages of tracker module.
if you have default settings for anonymous users, only the 'access content' permission is enabled, then
example.com/tracker - accessible
example.com/tracker/all - access denied
The menu item "Recent Posts" can be disabled, but the /tracker link is still accessible.
The tracker module should have own permissions.
But for drupal6 it would be enough for me if /tracker link would work as /tracker/all, meaning not accessible for anonymous user per default..
| Comment | File | Size | Author |
|---|---|---|---|
| #7 | tracker.module.txt | 2.78 KB | tracerul |
| #1 | tracker.module-D7-20-03-08.patch | 394 bytes | ricabrantes |
Comments
Comment #1
ricabrantes commentedThis bug is active in the D7.x-dev and the error happens on the tracker.module
In the "tracker" menu the permission is present according the "access content", and that makes sense. because on allowing the content view, it also should allow the tracker, because it is a complement module. In the case of "tracker/all" menu, the permission only allows access to authenticated users, but both menus return the exactly same results.
This patch sets the permission of "tracker/all" equal to the used on "tracker" and can be applied to D7 and D6.
Comment #2
magico commentedComment #3
gábor hojtsyDrupal 6.2 was released in the meantime and fixed this security issue.
Comment #4
amir simantov commented@Gábor - Why isn't the fix in 6.14? 6.x is dev, not release.
Comment #5
pasqualleThere is only one code repository for Drupal 6, and it gets released sometimes.
But you are right this issue is not fixed. The /tracker path still uses the basic "access content" permission. I do not want anonymous access for this path.
Comment #7
tracerul commentedI made some modifications in tracker module for recent posts link with permissions for anonymous or register users and i want to share with you.I hope to help you.Just rename tracker.module.txt to tracker.module.Overwrite old file with this on server.Deactivate tracker module and reactivate it.I think it`s work fine now.I wait yours comments.Scuse me for my bad english.And backup your files :)
Comment #8
pasqualleComment #9
shady_gun commented#1: tracker.module-D7-20-03-08.patch queued for re-testing.
Comment #11
Nephele commentedThis issue was fixed at some point in the last three years (see #3), so I'm changing the status to fixed.
Specifically, I've confirmed (in Drupal 7) that anonymous users can access both tracker and tracker/all. Furthermore, the line of code that the patch in #1 tries to remove no longer exists in the code.