Activity Tracker module does not allow to prevent anonymous users from seeing the users activity.

In case someone else lands here, I had a similar situation whereby I only want the administrator to view user activity.

Add the following to your custom module's mymodule.services.yml (where mymodule is our custom module's name)

services:
  mymodule.route_subscriber:
    class: Drupal\mymodule\Routing\RouteSubscriber
    tags:
      - { name: 'event_subscriber' }

Then create a route in your module's src\Routing\RouteSubscriber.php as follows:

/**
 * change permissions of actvity tracker module to admin only 
 * based on https://www.drupal.org/docs/8/api/routing-system/altering-existing-routes-and-adding-new-routes-based-on-dynamic-ones
 */
namespace Drupal\mymodule\Routing;

use Drupal\Core\Routing\RouteSubscriberBase;
use Symfony\Component\Routing\RouteCollection;



class RouteSubscriber extends RouteSubscriberBase {

  /**
   * {@inheritdoc}
   */
  protected function alterRoutes(RouteCollection $collection) {

    // Note that the second parameter of setRequirement() is a string.
    if ($route = $collection->get('tracker.page')) {
      $route->setRequirement('_permission', 'Administer content');
    }
	
	if ($route = $collection->get('tracker.users_recent_content')) {
      $route->setRequirement('_permission', 'Administer content');
    }
	
	if ($route = $collection->get('tracker.user_tab')) {
      $route->setRequirement('_permission', 'Administer content');
    }
  }

}

It would be useful to simply add Activity Tracker to the permissions list so that access can be set per User Role (i.e. not just anonymous vs authenticated).

+1 for adding this feature to Drupal 8/9, implemented as hazit described above. Thanks.

This is a security issue. Anyone can see all activities including admin ones. Must be fixed in core ASAP! Still exists in 9.1.4

I think also it's a security and SEO issue. That expose all usernames and potentially not published contents. It's not very critical but personnally, I have disabled this module for these reasons.

And people who enable this module do not know that it exposes user names and activities with NO access control permissions. I think it is quite critical. I found this by looking at my logs, and a hacker was accessing this page.

This seems more that it is a documentation issue and feature request, not a security issue?

There *is* access control via permission - if you have a closed site then anonymous users should not have the access content permission.

If the list includes unpublished node titles then it's access bypass

+1 for considering this as a security issue in that there is no warning that enabling this module exposes title information with no access checks which is very 'unDrupal' - and undermines module level protections such as Groups

The suggestion from 6 Apr 2010 #762962-45: Add permissions for the tracker pages for three permissions seems

From that issue: Proposed resolution

The patch in #45 adds these three permissions:

access global tracker
access other user's tracker
access own tracker

Seems a really good solution even 11 years on...

This extension is deprecated and scheduled for removal in Drupal 11.

This is now Postponed. The status is set according to two policies. The Remove a core extension and move it to a contributed project and the Extensions approved for removal policies.

It will be moved to the contributed extension once the Drupal 11 branch is open.

now in contrib

Using the contrib module on D11.

I am surprised to see that anonymous users can see the list of Recent content even if I set the view block permission to:

Role: Administrator

I wonder what is overriding the permission I set in the view.

/admin/structure/views/view/content_recent

Creating a custom module with a custom permissions.yml and routing.yml is one solution. But I would expect the module itself to handle permissions.

If we plan to add missing permissions to this module, let's change the issue to task and change the issue title to:

Add a new “access users activity” permission.

Pseudo code:

    access users activity:
      title: 'Access users activity'
      description: 'Allows users to view the activity tracker page.'

    tracker.activity_page:
      path: '/activity'
      defaults:
        _controller: '\Drupal\tracker\Controller\TrackerController::activityPage'
        _title: 'Activity'
      requirements:
        _permission: 'access users activity'

This can be resolved together with the conversion to Views: #1941830: Convert tracker listings to a view