This forum is for module development and code related questions, not general module support. For general support, use the Post installation forum.

Worrying about secure code...

Hey all

I need some advice with this... The only sure fire way I can see to test for permissions with what I'm trying to accomplish is to not set any access restriction in the menu hook and test for permissions in the callback function itself. Here's my code to test, although tbh it's quite irrelevant as it's not what I'm worried about...:

/**
 * Edits one row in a table.
 */
function tablemanager_edit($edit) {
  global $user;
  if (!is_numeric($edit)) {
    drupal_access_denied();
  }
  $fetch = db_fetch_object(db_query('SELECT tm.tid, tm.uid AS tableuid, tm.name, tmd.uid, tm.header, tmd.data, tmd.format
                                     FROM {tablemanager} tm
                                       INNER JOIN {tablemanager_data} tmd ON tm.tid = tmd.tid
                                     WHERE tmd.id = %d',
                                     $edit));
  if (!$fetch) {
    drupal_not_found();
  }
  unset($flag);
  $flag = $user->uid == $fetch->uid && user_access("edit own '".$fetch->name."' content") ? TRUE : $flag;
  $flag = user_access('administer tables') || user_access("edit any '".$fetch->name."' content") ? TRUE : $flag;
  $flag = $user->uid == $fetch->tableuid && user_access('administer/ create own tables') ? TRUE : $flag;
  if (!$flag) {
    drupal_access_denied();
  }
...rest of code....

What I'm worried about is how easy this is to bypass? Everyone has permission to access this function, they're only denied once they're actually 'in it'... So if they pass POST variables to it will they get stopped at the access denied message or will they actually get as far as the validate or *gasp* the submit hook??? I'm assuming I have nothing to worry about, but as a few people use my module now I don't want to make a mistake and open up a huge security hole :o(

A feature enrichment idea : style.css editor module

I dont have PHP skills to do this, so I thought someoene else might be interested in the community

TextPattern has an .css editor module -screenshot is here
http://textpattern.com/screenshots/?s=css

would it be possible this feature in Drupal?

Will page caching affect banner ad view counts?

Because we have a large network of sites that share ads, I've placed all our advertising in one database, and all our LAMP-based sites call that database for banner ad information, sort of like my own version of DoubleClick.

I've put those calls into a very simple Drupal module. Each time the drupal module loads, it gets ad information from the database, but also logs a +1 to a traffic table to mark the count of the times that each banner ad had been loaded into the site.

Need help creating a table with lookup table and add, delete, update.

Hello.

Does anybody know a way i can create å table with a lookup tables. I need also links for add, delete and update in a drupal page. I have createt a mysql table for It,
but ned the code for the table.

Ps! I have tested the table module, from the download section, but it lacks the possibility for a lookup table.

I am new, and any help would be highly appriciated.

Normann.

Sorry for bad English !!!

Automatically posting future nodes?

Is there a module that automatically posts future dated nodes? I tried putting my nodes 7 days ahead of the current date but it still gets published. I want it to be kept in the database until that date to appear published.

Any ideas?

Auto Keyword???

I noticed that auto path is a nice feature for SEO since it generates automaticaly clean urls for our website. So I'm wondering if theres a "Auto Keyword" module that generates the Keyword Meta automaticaly based on keyword density on a given node. Lets say the 8 most popular words will be added to the meta.

Pages

Subscribe with RSS Subscribe to RSS - Module development and code questions