Problem/Motivation

- Securise site

Steps to reproduce

- Install entityqueue
- Create a "Multiple subqueues" `
- Machine name multitest
- go InPrivate mode browsing
- go to page /admin/structure/entityqueue/multitest/add
- see the form in Public mode

Proposed resolution

- Add this line
_permission: 'administer entityqueue+manipulate entityqueues+manipulate all entityqueues'
in entityqueue.routing.yml file L65

Remaining tasks

- nothing

User interface changes

- nothing

API changes

- nothing

Data model changes

- nothing

Issue fork entityqueue-3323775

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

Julfabre created an issue. See original summary.

amateescu made their first commit to this issue’s fork.

amateescu opened merge request !64

amateescu’s picture

amateescu commented
Version: 8.x-1.3 » 8.x-1.x-dev
Status: Active » Needs review

I've submitted this issue to the security team, and it was triaged as "can be public". Opened a MR with the fix.

amateescu’s picture

amateescu commented
Title: Subqueue Add not securised » Subqueue add form is accessible without any entityqueue permission

  • amateescu committed 378694f4 on 8.x-1.x 
    fix: #3323775 Subqueue add form is accessible without any entityqueue...
amateescu’s picture

amateescu commented
Status: Needs review » Fixed

Merged, thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.