It is a rendering issue of admin/user/access.

When a permission string s1 is a subset of another permission string s2,
before rendering of admin/user/access, if the permission s1 is on then,
s2 appears on the page to be on even if it is in reality off.

you can recreate the issue by having 2 permissions:
publish *all* content and
unpublish *all* content

the patch attached fixes this border case scenario.

5.x-dev is affect, patch attached as d5_fix_permissions_on_amdin_access.patch.txt

7.x-dev is not affected.

CommentFileSizeAuthor
d6_fix_permissions_on_amdin_access.patch.txt1.16 KBmalaussene
d5_fix_permissions_on_amdin_access.patch.txt1.14 KBmalaussene
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Anonymous’s picture

Anonymous (not verified) CreditAttribution: Anonymous commented

Can someone test if this still an issue in D6? It does seem like a security concern.

Status: Needs review » Closed (outdated)

Automatically closed because Drupal 6 is no longer supported. If the issue verifiably applies to later versions, please reopen with details and update the version.