The toolbar integration doesn't sufficiently check whether the user has the "See all environment indicators" permission. If the user doesn't have the permission, it hides the environment name, but the toolbar color will still be changed.
1. Install environment_indicator, environment_indicator_toolbar and environment_indicator_ui
2. Define a name and background color for the current environment (at /admin/config/development/environment-indicator/current)
3. Assign the "Use toolbar" permission to anonymous users (just for the sake of an example - it works with any role)
4. As anonymous user, visit the page → The toolbar will have the defined background color, although the anonymous users do not have the "See all environment indicators" permission.
Add a permission check to ensure the toolbar color is only changed if the current user has the "See all environment indicators" permission
Implement a fix
Toolbar color only changes if user has sufficient permission
None
None
| Comment | File | Size | Author |
|---|---|---|---|
| #15 | 3536522-insufficient-permission-check-4.0.x.patch | 986 bytes | trackleft2 |
Show commandsStart within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #3
nico.b commentedOpened a MR to fix the issue.
The lint tests seem to fail, but shouldn't be related to the changes from the MR at all. All other tests seem to pass.
Comment #4
dhruv.mittal commentedReviewing this
Comment #5
trackleft2Comment #6
trackleft2Comment #7
dhruv.mittal commentedI've checked that issue persist and MR is resolving the issue so moving it to RTBC
Comment #8
trackleft2@dhruv.mittal & @nico.b I've merged a merge request on this issue #3535214: Performance Improvements that should resolve this issue as well. https://git.drupalcode.org/project/environment_indicator/-/commit/324362...,
This is not yet included in a release, but it has been added to the next release plan #3468997: [META] Release Plan for Environment Indicator Minor (feature) Release 4.1.0.
Comment #9
nico.b commented@trackleft2 While that (when looking at the code changes only) indeed seems to fix the issue, I'm wondering whether a fix for this issue is really something that should wait for a new feature release, especially considering it is a permissions-related issue?
Comment #10
jonraedeke commentedI was experiencing this issue on 4.0.24. While the MR solves the permission check for color, I'm now seeing the Environment Menu in the toolbar for a role that has no permissions related to this module.
Comment #11
jonraedeke commentedThis seems to be fixed in the 4.x dev release as indicated by comment #8.
Comment #12
trackleft2OK, I'll backport the fix to the 4.0.x branch and create a new 4.0.25 release.
Comment #14
trackleft2I've created a Merge Request, and a patch for use in the meantime. Please test, and let me know if it works for you, and we can create a new release.
Comment #15
trackleft2Comment #16
trackleft2Comment #18
nico.b commentedI can confirm that this patch/MR is also resolving the issue, so moving it to RTBC.
Comment #20
trackleft2