Problem/Motivation

Anonymous users can view the main project browser route. As this may potentially expose version information or allow triggering of installs, it should be permissions in the same way as the main "extend" page is.

Steps to reproduce

Spin up with the module. Ensure you are signed out. Visit /admin/modules/browse

Proposed resolution

Add permissions in project_browser.routing.yml

Remaining tasks

  • ✅ File an issue about this project
  • ✅ Addition/Change/Update/Fix to this project
  • ✅ Testing to ensure no regression
  • ✅ Automated unit/functional testing coverage
  • ☐ Developer Documentation support on feature change/addition
  • ☐ User Guide Documentation support on feature change/addition
  • ☐ Code review from 1 Drupal core team member
  • ☐ Full testing and approval
  • ☐ Credit contributors
  • ☐ Review with the product owner
  • ☐ Release

User interface changes

none (unless we decide to add permissions)

API changes

none

Data model changes

none

Release notes snippet

Adds permissions to the routes associated with Project Browser.

Issue fork project_browser-3258247

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

chrisfromredfin created an issue. See original summary.

gaurav.kapoor’s picture

gaurav.kapoor commented
Assigned: Unassigned » gaurav.kapoor
gaurav.kapoor’s picture

gaurav.kapoor commented
Assigned: gaurav.kapoor » Unassigned
Issue tags: +Novice

Gábor Hojtsy made their first commit to this issue’s fork.

Gábor Hojtsy opened merge request !21

gábor hojtsy’s picture

gábor hojtsy
he/him
Primary language Hungarian
Location Hungary
commented
Status: Active » Needs work

The test also needs to set up the user with proper permissions.

hmendes’s picture

hmendes commented
Issue summary: View changes
Status: Needs work » Reviewed & tested by the community

I tested the MR and it worked for me.
Steps:

  • As anonymous, i tried to enter /admin/modules/browse.
  • Before: i can see the content.
  • After: i receive "Access denied"
  • Created a user with only "Administer modules" permission.
  • I tried to enter /admin/modules/browse, and now i can see the content.

Changing this to RTBC.

chrisfromredfin’s picture

chrisfromredfin
he/him/his
Primary language English
Location Portland, Maine
commented
Status: Reviewed & tested by the community » Fixed

Thanks everyone!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.