Webform 4 default Views triggering Views access warning

Here's a patch which adds an security_review_views_access_ignore list which other modules can use to ignore known-safe views.

@adamfranco It looks like this would rely on the webform module (and other modules) to implement your custom hook to exclude the view from the security check. What do you think about having $ignore variable as a Drupal variable (in the variables table)? This could then be controlled by the security review module and uninstalled when the module was uninstalled.

$ignore = variable_get('security_review_views_ignore', array());

It also seems that a skip link next to each view name to add items to the $ignore array would be useful for non devs. But then this method would allow devs to use drush to set the array from the command line using vset.

Thanks for the feedback. A variable would be fine too. Yet another option would be to set the initial value to a variable, then pass that to a custom hook so that it could be modified that way as well. Something like (patch attached):

$ignore = variable_get('security_review_views_ignore', array());
drupal_alter('security_review_views_access_ignore', $ignore);

I tend to like hooks as I can implement them in a custom module and have that apply to many sites that module is installed on without a lot of data/variable changes, but that is a slight preference. The key thing is having some mechanism to ignore false-positives.

The last patch is zero bytes.

However, this seems like it's hiding a bug in webform rather than fixing the real bug which is views that don't have access.

From the issue summary:

This is OK (?), because it is only default views and they are loaded from a menu callback that itself does.

It's OK-ish. Until there is a mistake somewhere else and the view becomes visible to people who should not see it.

I'm closing this because I think it makes more sense to fix this in webform, e.g. #2499029: Add Default Views access control.

The discussion in #2499029: Add Default Views access control is not finished (last comment a year ago) ...

Independent of webform views I would like to have the ignore hook for views access (just like with writable files, unsafe tags and temporary files).

Attached patch is similiar to #2.
In addition to ignore whole views (view_name) it also offers to ignore a single display view_name:display_name).

I did not include the $ignore Drupal variable proposed in #3.
If we have an alter hook this can be implemented in a custom module.

Setting back to needs-review.

I am using the patch in #6 for quite some time now - I really like having a clean security review.
So: can anybody have a look at #6?
I think the patch is quite simple and similiar to the other check's alter possibilities (i.e. using a drupal_alter hook).

Going to agree with @greggles that this appears to be an issue on the webform side.