user_access('view revisions') is not used for the 'view' link

Created on 30 October 2013, about 11 years ago
Updated 16 December 2024, 5 days ago

In diff_menu_alter() the access callback is changed for the 'view' revision links. This becomes a problem when diff is disabled on a content type.

The diff callback does check 'administer nodes', but that's not enough, normal users should also be able to use this when they have this permission, diff enabled or not. And that still does not solve the problem, because the rendering of the view revision links and the 'view revision' button are both using the same function.

Install Drupal core, diff, workbench, workbench moderation to really enjoy this problem.

🐛 Bug report
Status

Closed: outdated

Version

3.0

Component

Code

Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024