The #description for $form['nodewords']['nodewords_nodetype_override'] links to an admin screen (admin/content/types/NODE_TYPE/edit without checking that the current user has access to view it, with the result that non-privileged users will get a 403 error if they follow it.

$form['nodewords']['nodewords_nodetype_override'] = array(
  '#type' => 'checkbox',
  '#title' => t('Override defaults with the following values'),
  '#description' => t('Override <a href="!settings-uri">Meta tags - node type</a> defaults with the values filled below.', array('!settings-uri' => url('admin/content/types/' . $form['type']['#value'] . '/edit'))),
  '#weight' => -50,
  '#default_value' => $node->nodewords_nodetype_override,
);

Obviously, this shouldn't be. The solution, of course, is to not include the hyperlink if the user lacks access to the page it points to. But what is the preferred way of handling a translatable string that may be different based on runtime conditions? You hate to have two different strings for the same interface element. You could conditionally check_plain() the string, but then you wouldn't be able to include markup in a string override. Is there a best practice for this?

Comments

traviscarden’s picture