If user has "mass upload images" permission, images can be
mass uploaded to CCK field irrespective of CCK field permissions.

How to reproduce:

- Created content type
- Enabled "Content Permissions" module (CCK 6.x-2.8)
- Created CCK field field_myimage (File/Image Fupload)
- Grant "mass upload images" permission to role X
- Grant Edit/View permission for field_myimage to role X
- Role X can mass upload images (one node per image created)
- Un-grant Edit/View permission for field_myimage to role X
- Role X can still mass upload images (one node per image created)

Comments

grandcat’s picture

grandcat commented
Status: Active » Postponed

FUpload don't check field permissions. That's true.

All these bugs will probably be fixed in a release for D7.

grandcat’s picture

grandcat commented
Status: Postponed » Needs work
skizzo’s picture

skizzo commented

will the fixes be backported to D6 later on? Thx.