Closed (fixed)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Reporter:
Created:
18 Jun 2019 at 15:13 UTC
Updated:
7 Jul 2019 at 21:19 UTC
Jump to comment: Most recent
Comments
Comment #2
nickonom commentedComment #3
mikelutzI have added the PAReview link for your module to the Issue Summary. There are a few issues in there that you need to resolve.
Additionally, I have some security concerns over the premise of this module. While I haven't tried to exploit it, at a glance I would think that this would open up an avenue for someone to introduce XSS vulnerabilities to a site. That being said, is someone needs the 'translate interface' permission to use this and that permission is a restricted access permission, then perhaps this is okay. I'll let the Security team weigh in on that one.
Comment #4
nickonom commentedHey Michael,
Thanks for your review. I've fixed all the inconsistencies and now the https://pareview.sh/pareview/https-git.drupal.org-project-disable_transl... does not give any more issues.
As for your security concern, it is mitigated on two levels:
(1) Please note that no user can use the new feature unless they are admin users or have access set to Translate page by Internationalization and String translation modules;
(2) However, even with proper access to the Translate page nothing happens unless such the privileged user specifically checks on the newly introduced checkbox.
In other words, the module does not change any access behavior to the Translate page, so if an unauthorized user somehow gained access to the page, then that's not because of this module. This module only gives a possibility to overcome frequently occurring validation error to only authorized users who already have access to the Translate page. If such users with access privileges do not check the box, then the default validations kicks in as usual.
Comment #5
avpadernoComment #6
klausiThanks for your contribution, looks good to me!
The "translate interface" permission already has the restrict access flag, so should only be given to trusted admin users. So I think it is ok to disable validation for those trusted users, therefore I don't see a security problem.
Comment #7
avpadernoThank you for your contribution! I am going to update your account.
These are some recommended readings to help with excellent maintainership:
You can find more contributors chatting on the IRC #drupal-contribute channel. So, come hang out and stay involved.
Thank you, also, for your patience with the review process.
Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.
I thank all the dedicated reviewers as well.