Drupal has the "restrict access" flag on permission to allow permissions to be flagged as potentially dangerous. One Click Upload sets this on all type of files (template) upload permissions. For the files like rar, zip, doc, xls this sounds good, however custom added templates (set of files) OR only image files are safe for non-admin users.

We have started auditing sites and use the `restrict access` flag in Drupal to determine if any of our non-admin roles have "risky" permissions. However One Click Upload is throwing false positives in this case.

CommentFileSizeAuthor
#5 ocupload-permission-3089604-5.patch2.75 KBsidharthap
#2 ocupload-permission-3089604-1.patch2.76 KBsidharthap

Comments

sidharthap created an issue. See original summary.

sidharthap’s picture

sidharthap
Primary language English
commented
Status: Active » Needs review
StatusFileSize
new ocupload-permission-3089604-1.patch2.76 KB

Initial patch. It provides a field in template configuration to make it restrict access or not. default set true.

sidharthap’s picture

sidharthap
Primary language English
commented
Category: Feature request » Bug report
timmillwood’s picture

timmillwood
Primary language English
Location 🏴󠁧󠁢󠁷󠁬󠁳󠁿 Wales, UK
commented 
+++ b/ocupload.inc
@@ -272,6 +273,13 @@ function ocupload_form_template($form, &$form_state, $template = NULL) {
+    '#description' => t('Check if warning message to display on permission page.'),

I know this is a checkbox, but I think the word "check" here could be confusing. So maybe just "Display warning message on permissions page." would be ok here?

sidharthap’s picture

sidharthap
Primary language English
commented
StatusFileSize
new ocupload-permission-3089604-5.patch2.75 KB

Thank you @timmillwood
Updated patch.