This module adds an entity operation "Newsletter". This means that in a view of nodes where there is an operations link with "Edit" and "Delete" an extra item appears if the node can be sent.

The module fails to check access when adding this link, so it appears for all users. However this is not a security issue because access is checked when the link is clicked, so anonymous users will see a 403.

Comments

AdamPS created an issue. See original summary.

adamps’s picture

StatusFileSize
new789 bytes
adamps’s picture

StatusFileSize
new882 bytes
adamps’s picture

Issue tags: +Plan to commit

  • AdamPS committed d31fbd1 on 8.x-2.x
    Issue #3119673 by AdamPS: Missing access check on entity operation
    
adamps’s picture

Status: Active » Fixed
Issue tags: -Plan to commit

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.