[drupal-devel] [bug] Incorrect access checking for username auto completion

[Thox]

Issue status update for 
http://drupal.org/node/24617
Post a follow up: 
http://drupal.org/project/comments/add/24617

 Project:      Drupal
 Version:      cvs
 Component:    node.module
 Category:     bug reports
 Priority:     normal
 Assigned to:  Anonymous
 Reported by:  drumm
 Updated by:   Thox
 Status:       patch

If the menu item stays in user.module and the permission changed to
'access user profiles', then any users that are 'administer nodes' but
not 'access user profiles' would get errors trying to use the
autocomplete.


The following would work, but I'm not sure if it's the right way to go:



<?php
'access' => user_access('access user profiles') ||
user_access('administer nodes')
?>




I think the 'access user profiles' permission is best to use, possibly
even going far enough to change the autocomplete field to a plain text
field if the user doesn't have the permission.




Thox



Previous comments:
------------------------------------------------------------------------

June 9, 2005 - 01:36 : drumm

The auto completion for user name on node edit pages checks
user_access('administer users') when it should be something more like 
node_access($node, 'edit').




------------------------------------------------------------------------

June 10, 2005 - 16:32 : Thox

-1


The current "Authored by" field is only for users "administer nodes"
permission.




------------------------------------------------------------------------

June 10, 2005 - 16:35 : Thox

Whoops, administer nodes != administer users. This makes things
different.


The true permission should be administer nodes... which almost suggests
that the autocomplete function should be part of node.module, not
user.module. It depends where else the autocomplete is used in the
future.




------------------------------------------------------------------------

June 10, 2005 - 16:57 : killes at www.drop.org

I think the function should stay in user.module, but node.module should
get a menu callback that utilizes it. This is not a problem as
user.module is a required module.




------------------------------------------------------------------------

June 10, 2005 - 20:40 : Thox

Attachment: http://drupal.org/files/issues/access.patch (1.55 KB)

Attached patch moves the menu entry from user.module into node.module
and fixes the permission check.




------------------------------------------------------------------------

July 5, 2005 - 19:24 : Dries

Say we wanted to make the Author-field on "edit comment" pages editable.
I think the permissions would clash, and you'd be able to by-pass
permissions if you have access to at least one (because they'd all
share the same callback).  So, I don't think this solution is
sufficiently generic and possibly insecure. Not?




------------------------------------------------------------------------

July 5, 2005 - 19:55 : moshe weitzman

I think some are compounding two separate idea. In my mind, the username
autocomplete callback needs a very minimal permission like 'view user
profile'. And that callback belongs in user.module. 


The decision about showing the author field and the responsibility for
validating its contents belong to node.module and comment.module (in
Dries' example).