I am working for a client and found that the "DrupalAuthenticatorImpl.php" for both filemanager and imagemanager has some loophole. If tinymce permission has been given to anonymous users and restrict access to filemanger/imagemanager, they will be able to use the McfileManager and McImageManager directly by accessing the link
http://www.example.com/modules/tinymce/tinymce/jscripts/tiny_mce/plugins...
There need to some change inorder to prevent this by changing the "DrupalAuthenticatorImpl.php" file.
filemanager\classes\Authenticators\DrupalAuthenticatorImpl.php
This function loggedin should be changed
Imagemanager
function isLoggedin() {
return user_access('access tinymce');
}
to
function isLoggedin() {
return user_access('access tinymce imagemanager');
}
The same is true for filemanager:
function isLoggedin() {
return user_access('access tinymce ');
}
to
function isLoggedin() {
return user_access('access tinymce filemanager');
}
This change will fix the permission issue.
I posted a bug report on tinymce forums http://tinymce.moxiecode.com/
This is just to let to know Druplicans who uses the TinyMCE plugins Mcfilemanger and Mcimagemanager