Attached is a patch which makes views check that a user should have access to the display before rending block contents.

Page displays do this through the menu system, but without this patch views can't provide access control for blocks using this same extensible system.

CommentFileSizeAuthor
#1 views_block_access_check_2.patch1.24 KBjmiccolis
views_block_access_check.patch1.31 KBjmiccolis

Comments

jmiccolis’s picture

jmiccolis commented
StatusFileSize
new views_block_access_check_2.patch1.24 KB

It looks like my original patch was doing more work that it needed to. Simpler patch attached.

merlinofchaos’s picture

merlinofchaos commented
Status: Needs review » Needs work

Hmm. $view->access() is already being tested in views_block prior to the execute_display() call there. In general I've preferred keeping access tests external, though for pages they became internal so that we could have multiple displays with the same path and it needed to move into the view for that. I don't see why we should check twice.

jmiccolis’s picture

jmiccolis commented
Status: Needs work » Closed (fixed)

Yep, I stand corrected. Thanks.