Currently all users with the permission "access administration pages" are able to access the module configuration. This permission is a bit too vague to be used in this context. Accessing configuration that affects the site functionality should require a stronger permission.

Defined a new permission and changed the menu items to use that as the access argument. Patch attached.

Issue originally discovered by https://www.drupal.org/u/balneum
Mentored by https://www.drupal.org/u/holist

CommentFileSizeAuthor
#2 2734129-admin-access-permission.patch6.56 KBdotsi
aws_amazon-permission.patch6.7 KBdotsi

Comments

dotsi created an issue. See original summary.

dotsi’s picture

dotsi commented
Issue summary: View changes
StatusFileSize
new 2734129-admin-access-permission.patch6.56 KB

Recreated the patch, this time actually following the instructions at https://www.drupal.org/node/707484.

dotsi’s picture

dotsi commented
Status: Active » Needs review
holist’s picture

holist commented
Version: 7.x-1.3 » 7.x-1.x-dev
Status: Needs review » Reviewed & tested by the community

Works as advertised, and yes, AWS configuration is not something for any content editor's eyes.

Patch fixes also whitespace, hence the changed "empty" lines.