The Profile Add route uses the ProfileAccessCheck class to check permissions, but in the case of singular profiles this page also allows editing of profile entities. Which since the page only tests for the add permission appears to allow any user to edit any other user's profile regardless of whether they have the 'edit any' permission or not.

I'm going to override this locally to enforce until patched.

CommentFileSizeAuthor
#7 profile_add_page_allows-2884434-7.patch8.96 KBmglaman
#5 profile_add_page_allows-2884434-5.patch4.57 KBmglaman
#3 profile_add_page_allows-2884434-3.patch1.52 KBmglaman
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

ramriot created an issue. See original summary.

mglaman’s picture

mglaman
Primary language English
Location WI, USA
CreditAttribution: mglaman at Centarro commented
Issue tags: -access permissions +Needs tests

I'm going to override this locally to enforce until patched.

Providing your patch is a good step to see how we can fix this. We'll also need a test for this.

mglaman’s picture

mglaman
Primary language English
Location WI, USA
CreditAttribution: mglaman at Centarro commented
Status: Active » Needs review
FileSize
profile_add_page_allows-2884434-3.patch1.52 KB

Failing test.

Status: Needs review » Needs work

The last submitted patch, 3: profile_add_page_allows-2884434-3.patch, failed testing. View results

mglaman’s picture

mglaman
Primary language English
Location WI, USA
CreditAttribution: mglaman at Centarro commented
Version: 8.x-1.0-alpha7 » 8.x-1.x-dev
Status: Needs work » Needs review
FileSize
profile_add_page_allows-2884434-5.patch4.57 KB

Fix + passing tests.

Status: Needs review » Needs work

The last submitted patch, 5: profile_add_page_allows-2884434-5.patch, failed testing. View results

mglaman’s picture

mglaman
Primary language English
Location WI, USA
CreditAttribution: mglaman at Centarro commented
Status: Needs work » Needs review
FileSize
profile_add_page_allows-2884434-7.patch8.96 KB

Fixed kernel test. Looks like this even exposed a bug.

This should have failed as the user only had "create" permission and could create other user profiles. Now tests that this is false for access.

    $this->assertTrue($this->accessManager->checkNamedRoute(
      'entity.profile.type.user_profile_form.add',
      ['user' => $web_user2->id(), 'profile_type' => $this->type->id()],
      $web_user3
    ));

  • mglaman committed 822cb46 on 8.x-1.x 
    Issue #2884434 by mglaman: Profile Add Page allows editing without...
mglaman’s picture

mglaman
Primary language English
Location WI, USA
CreditAttribution: mglaman at Centarro commented
Status: Needs review » Fixed

Access fixed!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.