Access check on CSV icon/link [#2851939]

Problem/Motivation

The CSV icon/link appear on the parent view and assume that the parent view and attached view have the same access conditions. If the parent view and the export view have different access rules this can lead to the CSV button being rendered and then leading to a 403 once clicked on.

Proposed resolution

Run an access check on the export display prior to rendering the CSV icon/link on the parent view.

Remaining tasks

Tests

User interface changes

Comment	File	Size	Author
#6	views_data_export_icon_access_2851939-6.patch	601 bytes	thtas
#6	8.x-1.x: PHP 7 & MySQL 5.5, D8.6 2 pass
#5	views_data_export_icon_access_2851939-5.patch	602 bytes	thtas
#5
#2	views_data_export_icon_access_2851939.patch	2.46 KB	Juterpillar
#2	8.x-1.x: PHP 7 & MySQL 5.5, D8.6 Patch Failed to Apply

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

13 February 2017 at 01:31

Juterpillar created an issue. See original summary.

Comment #2

Juterpillar CreditAttribution: Juterpillar at Catalyst IT commented 13 February 2017 at 01:34

File	Size
views_data_export_icon_access_2851939.patch	2.46 KB
8.x-1.x: PHP 7 & MySQL 5.5, D8.6 Patch Failed to Apply

I've attached a patch that implements an access check before rendering the CSV button/link.

Comment #3

Mikael Berger CreditAttribution: Mikael Berger as a volunteer commented 18 September 2017 at 16:58

Comment #4

Mikael Berger CreditAttribution: Mikael Berger as a volunteer commented 18 September 2017 at 17:01

The patch seems to work, I have implemented it in a site built with Drupal 8.3.7 and all is good.

Comment #5

thtas CreditAttribution: thtas commented 5 March 2018 at 04:53

File	Size
views_data_export_icon_access_2851939-5.patch	602 bytes

A different version of the patch attached with the same logic, just less lines of code changed.

Comment #6

thtas CreditAttribution: thtas commented 5 March 2018 at 04:59

File	Size
views_data_export_icon_access_2851939-6.patch	601 bytes
8.x-1.x: PHP 7 & MySQL 5.5, D8.6 2 pass

1 file was hidden/shown/deleted

File	Size
views_data_export_icon_access_2851939-5.patch	602 bytes

oops - fixed patch

Comment #7

kevin.dutra CreditAttribution: kevin.dutra at Workday, Inc. commented 8 October 2018 at 22:05

Status:

Active

» Needs review

Don't forget to mark it as needing review once you add a patch, otherwise people won't realize that there was progress made. :)

Comment #8

8 October 2018 at 22:06

The last submitted patch, 2: views_data_export_icon_access_2851939.patch, failed testing. View results

Comment #9

kevin.dutra CreditAttribution: kevin.dutra at Workday, Inc. commented 8 October 2018 at 22:10

Status:

Needs review

» Needs work

This change seems good to me and I've tested it out. The only thing that would be great to have is an automated test to ensure that a regression doesn't pop up.

Comment #10

jhedstrom

English

Portland, OR

CreditAttribution: jhedstrom at Phase2 for Workday, Inc. commented 8 October 2018 at 22:19

Interesting. This also happens with the core Rss and Opml style plugins, so an ideal fix would be in core (which just seems like not calling the attachTo() method would suffice).

Can you add a core bug, then a @todo comment to this patch noting that the code can be removed once the core bug is fixed (and also a link to the bug in the code comment).