Update admin_views default permissions to match security patch [#3095565]

Need to fix file.admin-content-file.inc to match the approach taken to fix the security issue in Admin Views.

The new version of Admin Views will automatically update any view with menu as the access type, but the code in the default File Entity view still needs to be updated:

$handler->display->display_options['access']['type'] = 'menu';

Should be changed to this:

$handler->display->display_options['access']['type'] = 'perm';
$handler->display->display_options['access']['perm'] = 'access administration pages';

See attached. Not sure if you'd prefer the default permission to be "administer files" instead of "access administration pages".

Comment	File	Size	Author
	file_entity-default_admin_views_perms-1.patch	1.23 KB	sgdev

Comments

Comment #1

20 November 2019 at 07:54

ron_s created an issue. See original summary.

Comment #2

sgdev commented 20 November 2019 at 07:57

Also should mention admin_views 7.x-1.7 does update the default File Entity admin_view if one exists, and sets the perm to access administration pages.

However, this patch will fix the situation where someone installs admin_views 7.x-1.7, applies admin_views_update_7100, and then later on installs File Entity with the improper permission.