From 6828096e7e647c539f0a1ee644aa2d361f9dbf80 Mon Sep 17 00:00:00 2001
From: Angie Byron <webchick@24967.no-reply.drupal.org>
Date: Fri, 10 Oct 2008 07:49:49 +0000
Subject: #284887 by Dave Reid and dww: Disable autocomplete if user does not
 have access to the callback.

---
 includes/form.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'includes')

diff --git a/includes/form.inc b/includes/form.inc
index a9472cba6..51d8916ad 100644
--- a/includes/form.inc
+++ b/includes/form.inc
@@ -2085,7 +2085,7 @@ function theme_textfield($element) {
   $extra = '';
   $output = '';
 
-  if ($element['#autocomplete_path']) {
+  if ($element['#autocomplete_path'] && menu_valid_path(array('link_path' => $element['#autocomplete_path']))) {
     drupal_add_js('misc/autocomplete.js');
     $class[] = 'form-autocomplete';
     $extra =  '<input class="autocomplete" type="hidden" id="' . $element['#id'] . '-autocomplete" value="' . check_url(url($element['#autocomplete_path'], array('absolute' => TRUE))) . '" disabled="disabled" />';
-- 
cgit v1.2.3