Block should only be injected if the current user has permission to view the block.

CommentFileSizeAuthor
#6 menu_inject_block-d7-role-specific-visibility-2018923-6.patch2.8 KBpetermallett
#3 menu_inject_block-role-specific-visibility-2018923-3.patch1.99 KBpetermallett
#1 2018923_menu_inject_block_role_access.patch1.8 KBfonant

Comments

fonant’s picture

fonant commented
Status: Active » Needs review
StatusFileSize
new 2018923_menu_inject_block_role_access.patch1.8 KB

OK, patch that works for me attached.

The new code queries the blocks_roles table to see if there are per-role access restrictions on the block, and if there are for the current user then it doesn't render the block.

The query is similar to the query in block_list() in blocks.module, but without checking that the block is enabled (as blocks to be injected into menus may not be enabled anywhere else, and the menu item is explicitly asking for them anyway).

fonant’s picture

fonant commented
Title: Block injection ignores role specific visibility settings » Block injection ignores role-specific visibility settings
petermallett’s picture

petermallett commented
Issue summary: View changes
StatusFileSize
new menu_inject_block-role-specific-visibility-2018923-3.patch1.99 KB

I wasn't sure how to get this patch to apply, so I remade it by hand with git with a few minor tweaks, posting here for documentation and committing on the 6.x-1.x branch

  • Commit 7344c3b on 6.x-1.x authored by fonant, committed by petermallett: 
    Issue #2018923 by fonant: Fix Block injection ignores role-specific...
petermallett’s picture

petermallett commented
Version: 6.x-1.2 » 7.x-1.x-dev
Status: Needs review » Needs work

Committed to the 6.x-1.x branch, updating the issue and moving back to Needs work as this issue is present for D7 as well

petermallett’s picture

petermallett commented
Status: Needs work » Needs review
StatusFileSize
new menu_inject_block-d7-role-specific-visibility-2018923-6.patch2.8 KB

Implemented a role-based visibility check in the d7 branch.