Problem/Motivation

Navigating to admin/structure/block as an anonymous user exposes the user to the help text for the page. The text is not correctly pass to hook_help.

Proposed resolution

Clean up the route checking if statement condition. timplunkett suggests

if (in_array($route_name, array('block.admin_display', 'block.admin_display_theme'))) {

Add an access check to the condition as well.

User interface changes

None.

API changes

None.

Original report by @jessebeach

CommentFileSizeAuthor
#5 drupal-2140315-5.patch675 bytesolli
#2 214031515-2.patch2.05 KBsidharthap
anon-user-block-help-access-error-2.png88.75 KBjessebeach

Comments

olli’s picture

olli commented

I dont think this is only block module issue. The system help block should not be visible on 403/404. From SystemHelpBlock::getActiveHelp():

    $router_path = $request->attributes->get('_system_path');
    // We will always have a path unless we are on a 403 or 404.
    if (!$router_path) {
      return '';
    }
sidharthap’s picture

sidharthap
Primary language English
commented
Status: Active » Needs review
StatusFileSize
new 214031515-2.patch2.05 KB

There seems some more modules has the same issue. here is a small patch to fix only block module issue.

Status: Needs review » Needs work

The last submitted patch, 2: 214031515-2.patch, failed testing.

jessebeach’s picture

jessebeach commented
Status: Needs work » Needs review

2: 214031515-2.patch queued for re-testing.

olli’s picture

olli commented
StatusFileSize
new drupal-2140315-5.patch675 bytes

Here is an alternative to fix the help block instead of block_help().

olli’s picture

olli commented
Issue tags: +Blocks-Layouts
olli’s picture

olli commented

I think this is a duplicate of #2073121: Help text from hook_help() is displayed on 404/403 pages.

olli’s picture

olli commented
Status: Needs review » Closed (duplicate)