Annonymus users have access to admin/structure/units-measure. That are high security implifications.

CommentFileSizeAuthor
#1 2338147-admin-ui-access-1.patch2.75 KBbucefal91

Comments

bucefal91’s picture

bucefal91 commented
Title: Annonymus access to admin/structure/units-measure » Anonymous access to admin/structure/units-measure
Version: 7.x-1.0-alpha2 » 7.x-1.x-dev
Status: Active » Needs review
StatusFileSize
new 2338147-admin-ui-access-1.patch2.75 KB

Hello!

That's a security hole you found. Thanks for reporting it! I've created a patch that addresses it. It fixes the issue for me.

By the way, not only admin/structure/units-measure path was publicly open, but also admin/structure/units-measure/[name-of-measure]/units-unit

The attached patch solves both security problems.

I've also slightly changed the spelling in the title ;)

fox_01’s picture

fox_01 commented

I have applied the patch to latest dev. I upgraded to the latest dev. After clearing the caches. I got a 403 which was good..

So worked in my case

  • bucefal91 committed 278433f on 7.x-1.x 
    Issue #2338147 by bucefal91: fixing a security issue, admin ui overview...
bucefal91’s picture

bucefal91 commented
Status: Needs review » Fixed

Awesome!

I've committed it into the module.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.