Security issue #65508

 by Berdir, greggles: [D7] Access callback set to true - all users can edit permissions.

Signed-off-by: Jason Savino <jasonrsavino@gmail.com>