udig [udig]

Please change only the status, when you upload new code; other metadata should not be changed.

1. /** 
   * Node retrieving function called via ajax
   */ 
   function ajax_slideshow_get_node_ajax($nid) {
     $node = node_load(array('nid'=>$nid)); 
     $output = node_view($node);
     print drupal_to_js(array('node'=>$output));
   }
   

   The function doesn't control if the user has access to the node, and returns the data for it.

2. The file LICENSE.txt needs to be removed; Drupal.org CVS doesn't allow to commit that file.

The permission access content is too generic; there could be a module that implements a more restrictive permission, and the code would be showing a node the user doesn't have permission to access. If you need to be sure the user has access to a node, you should use node_access(), using 'view' as first parameter (an alternative would be db_rewrite_sql()).

This is a security vulnerability, which would make the security team open a SA, if the code would be in Drupal.org CVS.

A little note: the content of ajax_slideshow.views_default.inc is not correctly indented.

Thank you for your contribution! I am going to update your account.

These are some recommended readings to help with excellent maintainership:

• Dries' post on Responsible maintainers
• Best practices for creating and maintaining projects
• Maintaining a drupal.org project with Git
• Commit messages - providing history and credit
• Release naming conventions.
• Helping maintainers in the issue queues

You can find more contributors chatting on the IRC #drupal-contribute channel. So, come hang out and stay involved.
Thank you, also, for your patience with the review process.
Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

I thank all the dedicated reviewers as well.