/node_invite/invite/$nid currently works for every node type and every node.

Nodes are invitable even when:

  1. The node's type is not in the list of invitable types
  2. When a specific node of an invitable type has set node invite to 'disabled' on the edit tab.

Performing a check for node_invites_enabled in the node_invite_send function seems to prevent this by showing a rather blank page instead:

function node_invite_send($form_state, $node) {
 $node->node_invites_enabled = _ni_node_is_enabled($node);
 if ($node->node_invites_enabled){

   // perform the function as normal
   // The rest of the function sits in here...
   global $user; //etc.

 }
 return $form;
}

Dave Shaw
Tribe Rising

Comments

hadsie’s picture

Version: 6.x-2.2 » 6.x-2.x-dev
Status: Needs review » Fixed

Thanks Dave!!

I've put a fix in for this one in CVS that will be in the next release of the module. Instead of blocking within node_invite_send() I've put the access control directly on the menu item.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.