Problem/Motivation

js_example module doesn't demonstrate basic security best practices on its routes.

We need to change that.

In the routes.yml file, it currently says:

  requirements:
    _access: 'TRUE'

This allows anyone with access to the site to see the page, which opens up other possible security concerns.

Proposed resolution

  • Change the routes.yml file to say something like this:
      requirements:
    _permission: 'access content'
  • Update the tool menu test to reflect that this route is not visible to anonymous users, and *is* visible once a user with 'access content' permissions has been logged in.
  • Amend any tests which use these routes to log in a user who can access them.
CommentFileSizeAuthor
#14 js_example_access_checking-2585593-8-14.patch2 KBandrew.mikhailov
#12 js_example_access_checking-2585593-8-12.patch2 KBandrew.mikhailov
#10 js_example-access_checking-2585593-10-2.patch2.19 KBsumthief
#2 js_example-access_checking-2585593-2-8.patch1.04 KBsumthief

Comments

Mile23 created an issue. See original summary.

sumthief’s picture

sumthief commented
Status: Active » Needs review
StatusFileSize
new js_example-access_checking-2585593-2-8.patch1.04 KB
mile23’s picture

mile23
Primary language English
Location Seattle, WA
commented
Status: Needs review » Needs work
mile23’s picture

mile23
Primary language English
Location Seattle, WA
commented
Status: Needs work » Needs review

Status: Needs review » Needs work

The last submitted patch, 2: js_example-access_checking-2585593-2-8.patch, failed testing.

The last submitted patch, 2: js_example-access_checking-2585593-2-8.patch, failed testing.

sumthief’s picture

sumthief commented
Status: Needs work » Needs review

Need manually review.

Status: Needs review » Needs work

The last submitted patch, 2: js_example-access_checking-2585593-2-8.patch, failed testing.

mile23’s picture

mile23
Primary language English
Location Seattle, WA
commented

If you click on the newest failing testbot run, you'll see that the patch causes failing tests.

So we have to figure out why the tests are failing, and then try another patch.

In this case, the results look like this:

fail: [Browser] Line 39 of modules/examples/js_example/src/Tests/JsExampleTest.php:
Visited examples/js_example

fail: [Browser] Line 39 of modules/examples/js_example/src/Tests/JsExampleTest.php:
Visited examples/js_example/weights

fail: [Browser] Line 39 of modules/examples/js_example/src/Tests/JsExampleTest.php:
Visited examples/js_example/accordion
sumthief’s picture

sumthief commented
Status: Needs work » Needs review
StatusFileSize
new js_example-access_checking-2585593-10-2.patch2.19 KB

Update tests for patch #2.

Status: Needs review » Needs work

The last submitted patch, 10: js_example-access_checking-2585593-10-2.patch, failed testing.

andrew.mikhailov’s picture

andrew.mikhailov commented
Status: Needs work » Needs review
StatusFileSize
new js_example_access_checking-2585593-8-12.patch2 KB

Corrected patch.

Status: Needs review » Needs work

The last submitted patch, 12: js_example_access_checking-2585593-8-12.patch, failed testing.

andrew.mikhailov’s picture

andrew.mikhailov commented
Status: Needs work » Needs review
StatusFileSize
new js_example_access_checking-2585593-8-14.patch2 KB

Sorry) I've create patch via phpStorm)
Now all should be fine.

andrew.mikhailov’s picture

andrew.mikhailov commented

Everything is ok) Please check and apply my patch)
Best regards!

andrew.mikhailov’s picture

andrew.mikhailov commented

Could you check this task?
Is everything correct for you or do we need to do some improvements?
Best regards.

marvil07’s picture

marvil07 commented
Status: Needs review » Fixed

Thanks!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.