Issue status update for http://drupal.org/node/19009 Project: Drupal Version: cvs Component: comment.module Category: bug reports Priority: critical Assigned to: chx Reported by: nazadus Updated by: chx Status: patch Attachment: http://drupal.org/files/issues/comment_reply_access_2.patch (1.56 KB) chx Previous comments: ------------------------------------------------------------------------ March 16, 2005 - 20:39 : nazadus I believe I have found a bug. If you goto http://www.etherpunk.com/comment/reply/180 (possibly NSFW) it allows you to view the posting (while you don't have permission to actually post, it still allows the page to get displayed). I found this out by using awstats on my box and found that a hidden page was getting hit fairly common that I really don't want getting shown (well, it's on the web, I know... but... I'd rather have more controlled access). Does this belong in the comment section for not obeying TAC? Can anyone confirm this on their site? Kenny ------------------------------------------------------------------------ March 16, 2005 - 21:02 : pyromanfo That's definitely something you need to take up with the comment module guys. It's not just taxonomy access control either, it's the core node_access hooks in Drupal. If they'll just check that before displaying a node for reply, that'd fix it no problem. ------------------------------------------------------------------------ March 16, 2005 - 21:20 : moshe weitzman filed under comment.module ... note that my big comment patch gets rid of this page entirely (consolidates under comment/edit) so it might make sense to apply my patch instead of fixing this. ------------------------------------------------------------------------ March 20, 2005 - 03:14 : chx Attachment: http://drupal.org/files/issues/comment_reply_access.patch (1.36 KB) moshe , http://drupal.org/node/18656 this does not seem to affect the permissions of the comment/reply path. I think the approach I have taken is blatantly simple: literally check for access. ------------------------------------------------------------------------ March 20, 2005 - 03:24 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_0.patch (1.51 KB) ------------------------------------------------------------------------ March 20, 2005 - 03:37 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_1.patch (1.56 KB)