Problem/Motivation

All users have access to the SPAM tab on the user's own page, even if they don't have access to the route provided by that tab.

Steps to reproduce

Log in as a user with no special permissions. Visit any user's page, including but not limited to the user's own page. Observe the SPAM tab.

Proposed resolution

This bug is caused by unneeded and incorrect implementation of hook_menu_local_tasks_alter in spambot.module, presumably created by the upgrader automated code conversion from Drupal 7. The link defined in spambot.links.task.yml already creates the SPAM tab on the entity.user.canonical route, so nothing else is needed.

CommentFileSizeAuthor
#2 spambot-spam_tab-3211476-2.patch1.61 KBdanchadwick

Comments

DanChadwick created an issue. See original summary.

danchadwick’s picture

danchadwick commented
Status: Active » Needs review
StatusFileSize
new spambot-spam_tab-3211476-2.patch1.61 KB
carsonw’s picture

carsonw
handsome / brilliant
commented
Status: Needs review » Reviewed & tested by the community
kala4ek’s picture

kala4ek
Primary language Russian
Location 🇷🇺 Novosibirsk
commented
Assigned: Unassigned » kala4ek
klemendev’s picture

klemendev commented

Any plans on getting this in a release? Seems to be RTBC.

  • DanChadwick authored 0b23a35 on 8.x-1.x 
    Issue #3211476 by DanChadwick, carsonw, kala4ek, KlemenDEV: SPAM tab...
kala4ek’s picture

kala4ek
Primary language Russian
Location 🇷🇺 Novosibirsk
commented
Assigned: kala4ek » Unassigned
Status: Reviewed & tested by the community » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.