This permission is needed for users to see the FAQ and is usually given to anonymous. It's mistakenly labelled as an administrative permission using 'restrict access'. The point behind 'restrict access' is to tell Drupal (and site builders) to beware giving this permission. The attached patch just removes the setting.

I found this because the https://www.drupal.org/project/security_review module flagged this access.

CommentFileSizeAuthor
#2 faq-view-faq-page-restrict-access-3207286-2.patch292 bytesdouggreen

Issue fork faq-3207286

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

douggreen created an issue. See original summary.

douggreen’s picture

douggreen commented
StatusFileSize
new faq-view-faq-page-restrict-access-3207286-2.patch292 bytes
mmbk’s picture

mmbk
Primary language German
Location Meißen
commented
Status: Needs review » Reviewed & tested by the community

Yes, the view access must not have the `restrict access` tag - but while reviewing this, I noticed that the `administer faq order` permission should not have the restricted access as well. As ordering the FAQs is a generic task for an editor, not for the administrator. So I tend to rename this permission to something like `edit faq order`.

douggreen opened merge request !7

  • stella committed 7944e6c9 on 8.x-1.x authored by douggreen 
    Issue #3207286 by douggreen: remove 'restrict access' from the 'view faq...
stella’s picture

stella commented
Status: Reviewed & tested by the community » Fixed

Committed now, thanks!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

shivansunfire’s picture

shivansunfire commented

Please @stella could you make a release so we use this fix without maintaining patches?