Problem/Motivation

cache_example module doesn't demonstrate basic security best practices on its routes.

We need to change that.

In the routes.yml file, it currently says:

  requirements:
    _access: 'TRUE'

This allows anyone with access to the site to see the page, which opens up other possible security concerns.

Proposed resolution

  • Change the routes.yml file to say something like this:
      requirements:
        _permission: 'access content'
    
  • Update the tool menu test to reflect that this route is not visible to anonymous users, and *is* visible once a user with 'access content' permissions has been logged in.
  • Amend any tests which use these routes to log in a user who can access them.
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Mile23 created an issue. See original summary.

sumthief’s picture

Status: Active » Needs review
FileSize
405 bytes
Mile23’s picture

Status: Needs review » Needs work
Mile23’s picture

Status: Needs work » Needs review
nicrodgers’s picture

Status: Needs review » Needs work

Patch looks great, well done!

Now all that remains is the final two items on the "Proposed resolution" list - updating the tests.

sumthief’s picture

@nicrodgers, I think there are unnecessary to update test because 'access content' provided "enable" state for anonymous by default.

nicrodgers’s picture

@Shlyapkin - that sounds sensible to me. If @Mile23 is happy, then we can remove those two items from the issue summary and RTBC it.

sumthief’s picture

Status: Needs work » Needs review

@Mile23, can you check tasks?

marvil07’s picture

Status: Needs review » Fixed

Thanks!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.