I have noticed that unpublished nodes are available via printable. For example if you allow anonymous users to use printable and this user submit printable url with nid for unpublished node, printable show node's content (regular access to node show "permissions denied").

Proposed solution

After little research I found that permission check for printable route is for some reason commented. I would give it back (see patch).

CommentFileSizeAuthor
printable-fix-missing-access-control-for-printable-nodes-d8.patch987 bytesmarysmech

Comments

marysmech created an issue. See original summary.

marysmech’s picture

marysmech commented
marysmech’s picture

marysmech commented
Issue tags: +Needs Review
marysmech’s picture

marysmech commented
Status: Active » Needs review
Issue tags: -Needs Review

  • marysmech authored 6ff0110 on 8.x-1.x 
    Issue #2873986 by marysmech: Unpublished nodes are available via...
nigelcunningham’s picture

nigelcunningham commented
Status: Needs review » Fixed

Tested and merged. Thanks!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.