By default, FPP doesn't show the fields when adding a reusable FPP widget, but panopoly_widgets puts them in, however, it doesn't actually check if the user has permission to update the entity.
This ISN'T a security issue, because FPP still prevents the user from saving!
But they get these fields when they can't actually save the data, and the live preview even updates if you change them, which gives the impression that the user can change them. This is a bug!
| Comment | File | Size | Author |
|---|---|---|---|
| #8 | panopoly_test-fpp-reusable-access-2881473-8.patch | 16.99 KB | cboyden |
| #5 | panopoly_magic-fpp-reusable-access-2881473-5.patch | 754 bytes | cboyden |
| #2 | panopoly_widgets-fpp-reusable-access-2881473-2.patch | 926 bytes | dsnopek |
Comments
Comment #2
dsnopekPatch is attached!
Comment #3
cboyden commentedThanks for looking at this. I've just tried it out and the functionality is great. It's a bit confusing, though, to be presented with the message "You don't have permission to edit this widget" along with a "Save" button. Would it be OK to update the button text to "Insert" or something, if the same access hook fails?
Looking at the results of all the form_alters, the change in button text can't be done in panopoly_widgets if panopoly_magic is also enabled. Panopoly_magic doesn't strictly speaking require FPP, but that's the place where the change has to go. I've attached an additional patch to panopoly_magic which does this.
Comment #4
dsnopekThanks! I'm not so sure about "Insert" - how about "Add"? And, for consistency, it'd be nice to use the new label whenever we're adding a new FPP, rather than just when we're adding one when we don't have access to edit it.
Comment #5
cboyden commentedThanks, I've updated the patch. Switching to checking for the op instead of checking for FPP access.
Comment #6
dsnopekThanks! Unfortunately, this is probably going to break all the tests :-)
Here's a build on Travis: https://travis-ci.org/panopoly/panopoly/builds/236147245
We'll probably need to update all our features that are adding an FPP to click "Add" rather than "Save"
Comment #7
cboyden commentedThis patch to panopoly_test should do it.
Comment #8
cboyden commentedMissed one instance in livepreview.feature, here's an updated patch.
Comment #9
dsnopekHere's a Travis build: https://travis-ci.org/panopoly/panopoly/builds/236363417
And it passed :-)
Comment #11
dsnopekCommitted! Thanks :-)