subscription_manager.permissions.yml defines administer subscription manager, administer subscription plans, administer subscriptions, and manage own subscriptions. But the code references four permissions that do not exist anywhere:
administer Subscription entities — the subscription entity's admin_permission, also used by its settings-form route (the Field UI base route).administer subscription plan entities — the subscription_plan entity's admin_permission, same settings-route usage.access Subscription overview — requirement on the /admin/content/subscription collection route.access Subscription plan overview — requirement on the /admin/content/subscription-plan collection route.Since no role can hold an undefined permission, both collection listings, both settings forms, and Field UI for both entity types are reachable only by user 1. It fails safe (deny), so this is an availability bug rather than a vulnerability, but any real admin role is locked out of half the module's admin UI.
Standardize on the defined permissions rather than defining four new ones: set the subscription entity's admin_permission and collection-route requirement to administer subscriptions, and the subscription_plan equivalents to administer subscription plans. This matches what the access control handlers already check for entity operations, so one permission governs each entity type consistently. Audit links.menu/task/action files for the same strings.
Patch; kernel test asserting a role with administer subscriptions can reach the collection and settings routes; change record noting the effective permission consolidation.
Admin collections and settings become reachable by appropriately-permissioned roles.
None.
None.
Show commandsStart within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #2
colanComment #4
colanMR opened, taking the consolidation route from the proposed resolution: the subscription entity's
admin_permissionand collection-route requirement becomeadminister subscriptions, and the subscription_plan equivalents becomeadminister subscription plans— the same permissions the access control handlers already check, so one permission now governs each entity type consistently. The settings-form routes readgetAdminPermission(), so they follow automatically, and the audit of the links.menu/task/action files found route references only (no permission strings), so nothing to change there.AdminRoutePermissionsTestasserts each admin route (collection and settings, both entity types) is reachable with its defined permission, not reachable with the other entity type's permission or by a permissionless user, and that bothadmin_permissionvalues exist in the defined-permissions list.Since the four removed strings never existed as permissions, no role can have them assigned, so there is nothing to migrate — the change record can note the consolidation for anyone who granted the strings via custom code.
Comment #5
colanComment #7
colan