As a parallel of #2600382: Come up with a simple access/permission system for Workspaces, we shouldn't allow users to switch to a workspace they don't have permission to see.

This patch may not work properly without the patch from that issue on workspace, but I haven't actually tried it independently, so... (But really, it should, because all it does is check entity access which doesn't need another module.)

There's also a little bit of code cleanup and refactoring in there that I did while figuring out what I needed to do here. It's not relevant to this issue but I thought it was a good change anyway and it was not worth splitting up the diff to exclude. Sorry. :-)

Comments

Crell created an issue. See original summary.

timmillwood’s picture

Status: Needs review » Needs work

To test this I setup a test user (with no other roles than Authenticated user, and default permissions for that), added the workspace switcher block which ships with Workspace module, and created a new workspace.

When logging in as the test user I could see the workspace switcher block, as I hadn't set any permissions for that block, when switching workspace I got the following message in a dsm:

You do not have access to view the Development workspace.
Now viewing workspace Development

I think this is the intended behaviour, but the dsm is confusing. My vote would be to remote the "New viewing workspace X" message from \Drupal\workspace\Form\WorkspaceActivateFormBase::submitForm and set this in \Drupal\multiversion\Workspace\WorkspaceManager::setActiveWorkspace if the active workspace successfully switched. Thoughts?

Edit: I think it's worth noting that I tested this patch on it's own, without applying the patch from #2600382: Come up with a simple access/permission system for Workspaces Assigned to: Crell.

Crell’s picture

Status: Needs work » Needs review
StatusFileSize
new5.81 KB
new1.92 KB

Actually I can do you one better. Exceptions FTW! This also removes the dsm() from a service, which shouldn't have it anyway. (I hope this passes...)

  • timmillwood committed 25bc462 on 8.x-1.x authored by Crell
    Issue #2692527 by Crell: Don't allow switching to an inaccessible...
timmillwood’s picture

Status: Needs review » Fixed

  • timmillwood committed c4fd184 on 8.x-1.x
    Revert "Issue #2692527 by Crell: Don't allow switching to an...
timmillwood’s picture

Status: Fixed » Needs work

Had second thoughts!

There are several places (mainly tests) where we set the the active workspace, and many of these wouldn't have an $account to go with them. We need a way to set an active workspace without checking access, maybe setActiveWorkspace(WorkspaceInterface $workspace, $access_bypass = FALSE)?

These are the places we're using it:

multiversion/src/MultiversionManager.php:136:  public function setActiveWorkspaceId($id) {
multiversion/src/MultiversionManager.php:138:    return $this->workspaceManager->setActiveWorkspace($workspace);
multiversion/src/Workspace/WorkspaceManagerInterface.php:44:  public function setActiveWorkspace(WorkspaceInterface $workspace);
multiversion/src/Workspace/WorkspaceManager.php:111:  public function setActiveWorkspace(WorkspaceInterface $workspace) {
multiversion/src/Tests/Views/WorkspaceTest.php:44:    \Drupal::service('workspace.manager')->setActiveWorkspace($new_workspace);
multiversion/src/Tests/MenuLinkTest.php:86:    $this->workspaceManager->setActiveWorkspace($this->newWorkspace);
multiversion/src/Tests/EntityStorageTest.php:349:    $this->workspaceManager->setActiveWorkspace($workspace);
multiversion/src/Tests/EntityStorageTest.php:376:    $this->multiversionManager->setActiveWorkspaceId(1);
multiversion/src/MultiversionManagerInterface.php:20:   * @see \Drupal\multiversion\Workspace\WorkspaceManager::setActiveWorkspace()
multiversion/src/MultiversionManagerInterface.php:22:  public function setActiveWorkspaceId($id);
multiversion/tests/src/Unit/WorkspaceManagerTest.php:183:   * Tests that setActiveWorkspace() sets the workspace on the negotiator.
multiversion/tests/src/Unit/WorkspaceManagerTest.php:185:  public function testSetActiveWorkspace() {
multiversion/tests/src/Unit/WorkspaceManagerTest.php:205:    $workspace_manager->setActiveWorkspace($workspace);
relaxed/src/Tests/ResourceTestBase.php:86:    $this->multiversionManager->setActiveWorkspaceId($this->workspace->id());
relaxed/src/BulkDocs/BulkDocs.php:146:    $this->workspaceManager->setActiveWorkspace($this->workspace);
relaxed/src/BulkDocs/BulkDocs.php:200:    $this->workspaceManager->setActiveWorkspace($inital_workspace);
workspace/src/Form/WorkspaceActivateFormBase.php:76:    $this->workspaceManager->setActiveWorkspace($workspace);
workspace/src/Tests/ReplicatorTest.php:42:    \Drupal::service('workspace.manager')->setActiveWorkspace($this->developmentWorkspace);
workspace/src/InternalReplicator.php:69:    $this->workspaceManager->setActiveWorkspace($source_workspace);
Crell’s picture

Hm. I detest boolean flags like that on methods, as they're a code smell.

The alternative is to move the permission check to everywhere that we call setActiveWorkspace(), which would resolve this issue but also open up a potential security issue; forget to call it once and bam, privilege escalation. Could we perhaps optionally provide a user to the method, and pass that to access()? Then at least in tests you could pass in a mock user.

  • timmillwood committed 25bc462 on 2692527 authored by Crell
    Issue #2692527 by Crell: Don't allow switching to an inaccessible...
  • timmillwood committed 3a4a4ab on 2692527 authored by Crell
    Issue #2692527 by Crell: Don't allow switching to an inaccessible...
  • timmillwood committed c4fd184 on 2692527
    Revert "Issue #2692527 by Crell: Don't allow switching to an...
timmillwood’s picture

StatusFileSize
new4.89 KB

Little more than a re-roll.

Tests running at https://travis-ci.org/dickolsson/drupal-multiversion/jobs/120100452

  • timmillwood committed e1042fd on 8.x-1.x authored by Crell
    Issue #2692527 by Crell: Don't allow switching to an inaccessible...
timmillwood’s picture

Status: Needs work » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

The last submitted patch, 3: workspace-permissions.patch, failed testing.

The last submitted patch, 3: workspace-permissions.patch, failed testing.

The last submitted patch, 3: workspace-permissions.patch, failed testing.