Thank you very much for creating a version of G2 for Drupal 5. I have read all the disclaimers and understand that this is not a supported version, and that it's for people who like to "live dangerously." I don't particularly like to live dangerously but would like to use the module anyway, so I'm reporting this bug.

Unfortunately it seems that even when no permissions are granted to anonymous users, this version of the module allows them to access the admin/settings/g2 page and save changes to the G2 configuration.

I think the "view g2 entries" access control setting may not work either.

I'm using Drupal 5.7.

Comments

fgm’s picture

fgm
Primary language French
Location Paris, France
commented
Status: Active » Postponed (maintainer needs more info)

Thanks for your message. I just checked on a 5.x site and admin/settings/g2 is not viewable by anonymous users. Since this is a security issue, can you contact me off-site with more details so I can see why it happens on your site and not on mine ?

pathscollide’s picture

pathscollide commented

Sorry for the delay -- I was travelling. I have sent you a PM.

drumm’s picture

drumm
he/him
Location NY, US
commented
Issue summary: View changes
Status: Postponed (maintainer needs more info) » Fixed

Publishing since this was fixed. There was no advisory since it was only present in dev releases.

Please report security issues confidentially in the future.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

fgm’s picture

fgm
Primary language French
Location Paris, France
commented

Thanks @Drumm : since this was a 2008 issue on the D5 version, I'm not sure there was already such a channel at the time, though.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.