Problem/Motivation

Anonymous users can see community secret flexible group teasers in "Custom content list block" block:
alt

Should be:
alt

Steps to reproduce

  1. Login as admin
  2. Create flexible groups with different visibilities: public, community, secret
  3. Create a "Custom content list block" on /block/add/custom_content_list
  4. Place block to any visible region on "Block layout" (for example, "Page title") to display created groups
  5. As anonymous user visit the page where this block appears

Proposed resolution

Add access check before entities view build.

Remaining tasks

n/a

User interface changes

n/a

API changes

n/a

Data model changes

n/a

CommentFileSizeAuthor
Screenshot 2023-02-06 at 12.40.43.png40.65 KBvnech
Screenshot 2023-02-06 at 12.33.43.png81.67 KBvnech

Comments

vnech created an issue. See original summary.

vnech’s picture

vnech commented
Issue summary: View changes
vnech’s picture

vnech commented
Status: Active » Needs review

PR -> https://github.com/goalgorilla/open_social/pull/3305

ribel’s picture

ribel
Primary language Ukrainian
Location 🇺🇦Lviv
commented
Version: 11.7.x-dev » 11.6.x-dev
Status: Needs review » Reviewed & tested by the community

Changes were tested and looks good to me.

  • nkoporec committed 727aa82f on 11.6.x authored by vnech 
    Issue #3339566 by vnech: Entity access check is applied in "Custom...

tbsiqueira credited nkoporec.

tbsiqueira’s picture

tbsiqueira
He/him
commented
Status: Reviewed & tested by the community » Fixed

  • nkoporec committed 44e64289 on 11.7.x authored by vnech 
    Issue #3339566 by vnech: Entity access check is applied in "Custom...

  • nkoporec committed 58477abc on 11.8.x authored by vnech 
    Issue #3339566 by vnech: Entity access check is applied in "Custom...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.