Problem/Motivation

Originally reported as a private issue but cleared to be made public
Anyone with the "administer contact forms" permission could add disgruntled.employee+sitenam@gmail.com to every contact form on the site. Then, any time a potential customer fills out a lead-generation form, the lead can be sold to the competition.

Steps to reproduce

Proposed resolution

Make this permission restrict access true

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork contact-3615115

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

larowlan created an issue. See original summary.

tribekk made their first commit to this issue’s fork.

tribekk opened merge request !5

tribekk’s picture

tribekk commented
Status: Active » Needs review

Opened MR !5.

Marks the administer contact forms permission as restricted, so the permissions UI warns before it is granted to an untrusted role.

Checked locally:
- git diff --check

  • larowlan committed 37f248ad on 1.x authored by tribekk 
    task: #3615115 Administer contact forms should be a restricted...
larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
commented
Status: Needs review » Fixed

Thanks - committed to 1.x

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.