If I'm reading the code correctly, enabling this module allows ANY user to download the contents of ANY field in ANY node on the site, regardless of whether the node is published or unpublished and bypassing any security restrictions.

The menu hook is

  $items['js_editor/download/%/%/%'] = array(
    'title' => 'Downloading json...',
    'page callback' => 'json_editor_download_json',
    'page arguments' => array(2, 3, 4),
    'access callback' => TRUE,
    'type' => MENU_NORMAL_ITEM,
  );

Since "access callback" is "TRUE", anybody can access this menu item. The target function, "json_editor_download_json", just does a node_load, grabs the "value" column, and returns the results (json encoded).

Comments

samnelson created an issue.