Problem/Motivation

Some popular contrib modules (e.g. webform) provide views without permission checks.
There is a request to add access checks to webform but the discussion in #2499029: Add Default Views access control is not finished (last comment two years ago).
So I think a possibility to whitelist whole views or view displays would be quite nice.
There is a similiar issue #2687099: Webform 4 default Views triggering Views access warning for the 7.x branch with a patch but I think for 3.0.x we should use the setting mechanism already provide by security review.

Other modules providing views without access check are commerce and profile (see #3259261: Missing Views access restrictions according to Security Review module)

Steps to reproduce

Enable webform and security review's "Views access" check. Run the check and you'll get a failure "Webform submissions: default".

Proposed resolution

Remaining tasks

None.

User interface changes

None.

API changes

None.

Data model changes

No real data model changes but new config settings for ignores.

CommentFileSizeAuthor
#5 security_review-whitlist-views-3216263.patch2.31 KBgngn
#2 security_review-whitelist-views-3216263-2-d8.patch2.69 KBgngn

Issue fork security_review-3216263

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

gngn created an issue. See original summary.

gngn’s picture

gngn commented
Issue summary: View changes
Status: Active » Needs review
StatusFileSize
new security_review-whitelist-views-3216263-2-d8.patch2.69 KB

Patch as proposed above.

smustgrave’s picture

smustgrave commented
Status: Needs review » Postponed
Related issues: +#3224996: Only check default view access if it is used, +#1172090: Ability to "hush" individual warnings

Can you see if https://www.drupal.org/project/security_review/issues/3224996 would address your issue? if not I think https://www.drupal.org/project/security_review/issues/1172090 will definitely.

smustgrave’s picture

smustgrave commented
Status: Postponed » Closed (outdated)

Closing as outdated. If still an issue please test on 2.x branch and reopen please

Thanks!

gngn’s picture

gngn commented
Version: 8.x-1.x-dev » 3.0.x-dev
Issue summary: View changes
Status: Closed (outdated) » Needs review
Related issues: +#3259257: Missing Views access restrictions according to Security Review module, +#3259261: Missing Views access restrictions according to Security Review module
StatusFileSize
new security_review-whitlist-views-3216263.patch2.31 KB

I reopen this for 3.0.x because it is still an issue, I do not think the other modules are going to provide access checks and I really like to have a clean security review ;)

The patch is a bit smaller than the one provided for 8.x in #2 (mainly because we already have config for the views access check).
Like #2 you can enter whole views or distinct displays to ignore (i.e. "webform_submissions" or "webform_submissions:embed_default").

I also updated the description.

smustgrave’s picture

smustgrave commented
Status: Needs review » Needs work

Will have to think about adding this one but fixes should be in MRs

gngn opened merge request !77

gngn’s picture

gngn commented
Status: Needs work » Needs review

I created a MR.
hope everything went OK (I'm still not used to MRs).

smustgrave’s picture

smustgrave commented
Status: Needs review » Needs work

Will need to update schema + update hook.

smustgrave’s picture

smustgrave commented
Version: 3.0.x-dev » 3.1.x-dev
Assigned: Unassigned » smustgrave

Finally have test coverage for this plugin so we can land this feature.

smustgrave changed the visibility of the branch 3216263-whitelist-views to hidden.

smustgrave opened merge request !92

smustgrave closed merge request !92

smustgrave reopened merge request !92

smustgrave closed merge request !77

smustgrave’s picture

smustgrave commented
Status: Needs work » Needs review

smustgrave’s picture

smustgrave commented
Status: Needs review » Fixed

Want to try out on latest 3.1.x

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.