Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

has_privs() can return true when user does not have access #305

Closed
ghost opened this issue Oct 4, 2014 · 1 comment
Closed

has_privs() can return true when user does not have access #305

ghost opened this issue Oct 4, 2014 · 1 comment
Labels
security
Milestone
v4.6

Comments

@ghost
Copy link

ghost commented Oct 4, 2014

From jukka.m.svahn on October 29, 2012 22:03:14

This can happen if $txp_permissions array value contains an empty byte (0, '', false) or trailing comma.

If this ever happens, non-authenticated users and non-existing users have access to that specific resource.

This means that there is no way to set permissions completely off while still keeping the resource registered.

Original issue: http://code.google.com/p/textpattern/issues/detail?id=301
@ghost
Copy link
Author

ghost commented Oct 4, 2014

From jukka.m.svahn on October 29, 2012 14:19:19

This issue was closed by revision r4511 .

Status: Fixed

@ghost ghost closed this as completed Oct 4, 2014
@ghost ghost mentioned this issue Oct 4, 2014
Open
@philwareham philwareham added this to the v4.6 milestone Oct 4, 2014
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
security
Projects
None yet
Milestone
v4.6
Development

No branches or pull requests
1 participant
@philwareham