Problem/Motivation

As I updated to the latest alpha yesterday, the security scan this morning grabbed the 4 views that come with it to be not access controlled. This should be added as a measure of caution, even if those views only come with blocks and don't have canonical routes.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork activitypub-3580428

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

jurgenhaas created an issue. See original summary.

swentel’s picture

swentel commented
Category: Bug report » Task

Makes sense, especially if people start adding pages themselves, and it's easy to forget setting access control on views. They are rendered by a controller at this point which does the access checking (the previous user overview didn't have a permission set either).

I'll set set some sensible defaults. The admin overviews will be easy as I have a dedicated permission for those. For the user, I'll probably have to write a views access plugin, but that's fine.

swentel opened merge request !56

swentel’s picture

swentel commented
Title: New views in latest version come without access control » Issue #3580428: add access control to default views
swentel’s picture

swentel commented
Title: Issue #3580428: add access control to default views » Add access control to default views

  • swentel committed d6c3de1d on 1.0.x 
    Issue #3580428: add access control to default views
swentel’s picture

swentel commented
Status: Active » Fixed

All views have access control now. activitypub_update_8033() will reinstall those views (the code activitypub_update_8028() has been removed so it isn't installed twice for users still on alpha21)

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.