Problem/Motivation

The navigation links are printed for all users, regardless of whether they have permission to print or not. There is no security risk as there is access checking at the destination page when the link is clicked.

Steps to reproduce

  1. Grant no permissions from this module (so only admins have access)
  2. As anonymous user, visit a page with a print link configured
  3. See the print link is present, click on it, get access denied.

Proposed resolution

Add an access check in printable_entity_view().

      '#access' => \Drupal::currentUser()->hasPermission('view printer friendly versions'),

Remaining tasks

User interface changes

API changes

Data model changes

Comments

adamps created an issue. See original summary.

nigelcunningham’s picture

nigelcunningham commented
Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

  • nigelcunningham committed 65f474b7 on 3.x 
    Issue #3563512 : Links are rendered even without permission

Signed-off-...
adamps’s picture

adamps commented

Great thanks for a quick response

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.