Problem/Motivation

The view "spam_list" page display is currently accessible to anonymous users.

This exposes spam entries publicly, which should not be possible. The spam list is an administrative tool and should only be accessible to users with proper permissions.

Steps to reproduce

  1. Enable the module.
  2. Visit the spam list page as an anonymous user.
  3. The page is accessible instead of returning 403 Access Denied.

Only users with the permission "administer nobotiq_spam_protection_status" should be able to access the spam list page.

Anonymous users must receive a 403 Access Denied response.

Proposed resolution

Restrict access to the page display of the "spam_list" view by setting:

Access type: Permission
Permission: administer nobotiq_spam_protection_status

This ensures the spam list is only accessible to administrators.

Issue fork nobotiq_spam_protection-3590640

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

yurii novak created an issue. See original summary.

yurii novak opened merge request !7

  • voleger committed 3273e9b9 on 1.0.x authored by yurii novak 
    fix(security): #3590640 Spam list page is accessible to anonymous users...
voleger’s picture

voleger
he/his
Primary language Ukrainian
Location Ukraine, Rivne
commented
Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.