The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.The subscriptions block created by the notifications_ui module does not respect permissions. This means that the block a user who does not have proper permissions to create subscriptions will be allowed to see the block giving them access to "Subscribe to" options. Attempting to subscribe fails because the permission is respected by other aspects of the subscription module. A simple patch is attached. The work around is to change the roll settings for the block visibility in the block settings.
| Comment | File | Size | Author |
|---|---|---|---|
| notifications_ui_block_permissions.patch | 775 bytes | lliss |
Comments
Comment #1
webflo commentedCommitted with modifications. Commit c7a915d on 7.x-1.x. Thanks!
Comment #2
sharplesa commentedwebflo,
Looks like this commit needs to go on the dev branch, too. Right?
Comment #3
webflo commentedUhm? There is no "dev" branch. Do you mean my development sandbox? The dev release is rolled by drupal.org packaging scripts twice a day.
Comment #4
sharplesa commentedSorry, that's my ignorance talking. I just wanted to make sure that what you pushed into production for alpha1 was also in git and available when you generate the next -dev release. So, I guess that means that the changes you made were made in the remotes/origin/7.x-1.x branch, right?