Just as the title says. Right now the permissions are too open. We need to limit user roles to specific bundles for this module. This should be a serious help to security issues with entities that support bundles.

CommentFileSizeAuthor
#6 entity-js-bundle-access-1704320-6.patch7.52 KBdsdeiz
#4 entity-js-bundle-access-1704320-3.patch7.79 KBsaltednut
#3 entity-js-bundle-access-1704320-2.patch6.68 KBsaltednut
#1 entity-js-bundle-access-1704320-1.patch6.72 KBsaltednut

Comments

saltednut’s picture

saltednut
she/her
Primary language English
Location Chicago
commented
StatusFileSize
new entity-js-bundle-access-1704320-1.patch6.72 KB

Here's an initial patch. This could perhaps use some refactoring to make the code cleaner but it works from my tests.

saltednut’s picture

saltednut
she/her
Primary language English
Location Chicago
commented
Assigned: Unassigned » dsdeiz
Status: Active » Needs review
saltednut’s picture

saltednut
she/her
Primary language English
Location Chicago
commented
StatusFileSize
new entity-js-bundle-access-1704320-2.patch6.68 KB

Had some issues in #1 with Updating and Deleting entities that do not use bundles.

saltednut’s picture

saltednut
she/her
Primary language English
Location Chicago
commented
StatusFileSize
new entity-js-bundle-access-1704320-3.patch7.79 KB

Should work with the latest branch and some very minor cleanup.

saltednut’s picture

saltednut
she/her
Primary language English
Location Chicago
commented
Assigned: dsdeiz » Unassigned
dsdeiz’s picture

dsdeiz commented
StatusFileSize
new entity-js-bundle-access-1704320-6.patch7.52 KB

This works on my end as well. Just some minor refactoring on generating the permissions.

saltednut’s picture

saltednut
she/her
Primary language English
Location Chicago
commented
Status: Needs review » Fixed

marking as fixed - nice cleanup on the permissions! dsdeiz++ http://drupalcode.org/project/entity_js.git/commit/7e73f19

saltednut’s picture

saltednut
she/her
Primary language English
Location Chicago
commented
Status: Fixed » Closed (fixed)
saltednut’s picture

saltednut
she/her
Primary language English
Location Chicago
commented
Issue summary: View changes

Updated issue summary.