by localhorse » 10 Nov 2009, 10:50
Hi guys! I've installed the mod and everything seems to work fine but one thing. I'm not sure if this is the intended behaviour or not, but on the calendar page (/mycalendar3.php) if a user doesn't have read access to a thread/event, it still shows up in the calendar, which to me seems like a security issue.
It does what I would think is proper behaviour on /index.php, that is, if a user doesn't have read access to the thread it simply doesn't show it, whereas in /mycalendar3.php if a user doesn't have read access it still shows the topic title, but in italics.
I've been looking through the code and there are a couple of variables in there, $can_view and $can_read, but even setting these both to false yields the same results.
Is this project still active? Has anyone else noticed these results? Perhaps I just have something setup wrong. I've double checked the permissions and there doesn't seem to be any problem there. And as I say, /index.php yields the expected results, so I think it's just a problem with /mycalendar3.php. Anyone have any ideas?
Thanks in advance.