Hello,

I randomly found that anonymous users can access the feed list page /admin/content/feed because the view does not provide access check.

I think to also change the permission for the page in routing.yml to use the access feed overview page.

I will upload a patch.

CommentFileSizeAuthor
#2 feeds-anonymous_access-2836998-2.patch1.3 KBgrimreaper

Comments

Grimreaper created an issue. See original summary.

grimreaper’s picture

grimreaper
Primary language French
Location France 🇫🇷
commented
Assigned: grimreaper » Unassigned
Status: Active » Needs review
StatusFileSize
new feeds-anonymous_access-2836998-2.patch1.3 KB

Here is the patch.

After checking how works admin/content, I have only modified the view config.

Does this need a hook_update?

daboo’s picture

daboo commented

This is controllable via permissions under Feeds -> Access the Feed overview page". I merely changed it to Administrator to keep others from accessing.

grimreaper’s picture

grimreaper
Primary language French
Location France 🇫🇷
commented

Hello @daboo,

The problem is that this permission is not used by the view provided by default.

And as the view responds on the same URL a default route in feeds.routing.yml has, even if the route requires this permission, anonymous users can access the listing.

daboo’s picture

daboo commented

Thanks for the update @Grimreaper. I wasn't aware of that.

  • MegaChriz committed 129e53d on 8.x-3.x authored by Grimreaper 
    Issue #2836998 by Grimreaper: Fixed anonymous can access feeds listing (...
megachriz’s picture

megachriz
Primary language Dutch
commented
Priority: Normal » Critical
Status: Needs review » Fixed

Great catch! Seems pretty critical too. I can confirm that the patch fixes the issue if I re-import the configuration file.

I think there is no need for a hook_update now, as there is no official release of Feeds 8.x-3.x yet, only a dev release.

grimreaper’s picture

grimreaper
Primary language French
Location France 🇫🇷
commented

OK.

Thanks for the commit.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.