Problem/Motivation

Opus 4.8 analysis:

Route-restriction relies on a typo'd permission (fails closed, but fragile)

  DecoupledJsonLogLimitingRouteSubscriber.php:44 sets the JSON:API GET requirement to 'administer log_json type' — the actual
  permission (permissions.yml) is administer log_json types (plural). A non-existent permission is granted to no one, so GET fails
  closed (not an exposure), but it also means admins can't GET logs via JSON:API, and it signals the restriction logic isn't tested
  against the real permission name. Also note this subscriber only filters jsonapi.* routes; non-POST REST methods are blocked only
  because rest.resource.entity.log_json.yml happens to declare POST only — there's no defense-in-depth if that config changes.

Issue fork decoupled_json_log-3605228

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

ptmkenny created an issue. See original summary.

ptmkenny opened merge request !23

ptmkenny’s picture

ptmkenny commented
Title: Access: permission is checked incorrectly » Access: admin permission is checked incorrectly

  • ptmkenny committed da0203f6 on 1.0.x 
    fix: #3605228 Access: permission is checked incorrectly

By: ptmkenny
ptmkenny’s picture

ptmkenny commented
Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.