Hello there. Upon running the tests in the Security Review module, it reported that the following Views don't have any access restrictions:

  • Cart block: default
  • Cart form: default
  • Checkout Order Summary: default
  • Order items: default

I don't know if any of them are actually a security risk since they're probably displayed in places that already have access control (e.g. the cart block), but wanted to verify or add the missing permissions to prevent false positives in the future for other users of the Security Review module.

Comments

Ambient.Impact created an issue. See original summary.

bojanz’s picture

bojanz commented

The Security Review module should stop analyzing views without a page display. An embedded view is access controlled by the page doing the embedding.

jsacksick’s picture

jsacksick commented
Category: Feature request » Support request
Status: Active » Fixed

That's exactly what I was about to reply, thanks @bojanz.

ambient.impact’s picture

ambient.impact
they/them
Primary language English
Location Toronto
commented

I would hope that to be the case, but technically the module has no way of knowing how you use the Views you define in all circumstances, and there's always the chance someone is using a View in an insecure way, outputting it without the proper access restrictions. I'd argue that Security Review flagging Views even if they don't have a page display is better than ignoring them and possibly letting a security hole go unnoticed. Maybe their UX can be improved and they can list those without page displays separately, with the caveat that they might be secure depending on how they're displayed? I can open an issue with them for that.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.