Module currently uses "view revision" permission for all operations (view, revert and delete revision) which is a security issue. We need to fix that and add proper permissions.

  • Add revert, delete all media revisions permission
  • Add revert, delete {media_type} revisions permissions
  • Add checks for permissions to src/Access/MediaRevisionAccessCheck.php
  • Write tests
CommentFileSizeAuthor
#6 interdiff_5-6.txt663 byteskbrodej
#6 3149796-6.patch19.41 KBkbrodej
#5 3149796-5.patch19.4 KBbcizej
#5 interdiff_4-5.txt24.1 KBbcizej
#4 3149796_4.patch17.58 KBnejcramsak
#4 interdif_2-4.txt3.87 KBnejcramsak
#2 3149796_2.patch15.83 KBnejcramsak

Comments

benjamincizej created an issue. See original summary.

nejcramsak’s picture

nejcramsak commented
StatusFileSize
new 3149796_2.patch15.83 KB

Added permissions and permission check and wrote tests.

nejcramsak’s picture

nejcramsak commented
Status: Active » Needs review
nejcramsak’s picture

nejcramsak commented
StatusFileSize
new interdif_2-4.txt3.87 KB
new 3149796_4.patch17.58 KB

Fixed access check permissions.

bcizej’s picture

bcizej commented
StatusFileSize
new interdiff_4-5.txt24.1 KB
new 3149796-5.patch19.4 KB

Thanks @nejcramsak but the access permissions do not check if the view/update/delete media item permission is set along with the view/update/delete revision permissions. I've added a patch for this and I refactored the tests.

kbrodej’s picture

kbrodej commented
StatusFileSize
new 3149796-6.patch19.41 KB
new interdiff_5-6.txt663 bytes

Hi. Reviewed the patch from #5. Tested the permission combinations and run the tests. Works as expected.

However I did find an minor CS issue with t() function. Patch attached.

bcizej’s picture

bcizej commented
Status: Needs review » Fixed

Reviewed and commited, thanks everyone.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.