See SA-CORE-2011-003 - there is an access bypass issue in Comment module that was fixed in Drupal 7. This fix needs to be applied to the 8.x development branch also.

I've uploading the patch from Drupal 7 to this issue (taken from http://drupalcode.org/project/drupal.git/patch/b38a806). It seems to apply to D8, but beyond that I haven't checked that it's good.

CommentFileSizeAuthor
b38a806.patch2.28 KBDavid_Rothstein
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Anonymous’s picture

Anonymous (not verified) CreditAttribution: Anonymous commented
Status: Needs review » Reviewed & tested by the community

Tested and it works.

I added a fielfield with Private access to the comment. I then created a node, commented with a file on the node, and unpublished the node.

When I visited with an anonymous user, without the patch I had access to the file. With the patch, I did not.

RTBC.

catch’s picture

catch
he/him
Primary language English
CreditAttribution: catch commented
Status: Reviewed & tested by the community » Fixed

Thanks! Committed and pushed to 8.x.

Automatically closed -- issue fixed for 2 weeks with no activity.