Problem/Motivation

Currently anonymous users can access routes to delete, view, and edit group content links, e.g.: -

/group/2/content/98
/group/2/content/98/delete
/group/2/content/98/delete
/group/2/content/98/edit

This is regardless of permissions in place in the group settings. The view and edit routes show nothing, but the delete route does allow the button to be clicked and the relation to be deleted by ANYONE.

The issue arises from GroupOwnsContentAccessCheck::access, which returns allowed, due to the group ID matching the group owns content.

Steps to reproduce

Create a group, create some group content, copy the delete relation link into an anonymous browser session.

Proposed resolution

Have an entity access check which returns denied further up the chain.

Remaining tasks

Investigate best solutions, create fix, and merge.

User interface changes

Prevent anonymous users from accessing routes they should not have access to.

Comments

Dubs created an issue. See original summary.

dubs’s picture

dubs commented
Title: Anonymous users can access group content links INCLUDING delete relations » Anonymous users can access group content routes INCLUDING delete relations
dww’s picture

dww
we/he/they
commented
dww’s picture

dww
we/he/they
commented
Category: Bug report » Support request
Priority: Critical » Normal
Status: Active » Fixed
Related issues: +#2991698: Why does Route access checking differ from Entity access checking?

I originally unpublished this since it sounded like a security bug that should have been reported at security.drupal.org. We went through that process, to discover the original reporter here had some core patches applied from #2991698: Why does Route access checking differ from Entity access checking? that caused the trouble. Since this was all cleared by the sec team to be handled in public, re-publishing this now and moving it to a support request...

Thanks,
-Derek

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.