In a couple of custom block DVG loads and renders nodes without checking node_access. This can easily be fixex by calling node_access('view', $node) before node_view().

CommentFileSizeAuthor
#1 check_node_access-2532068-1.patch1.9 KBmrharolda

Comments

mrharolda’s picture

Status: Active » Needs review
StatusFileSize
new1.9 KB
ralphvdhoudt’s picture

Status: Needs review » Fixed

Fixed in latest dev

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.