Problem/Motivation

Even though Twig is considered relatively secure, it is possible to access entity data using Twig functions include in the Twig Tweak module. Users should not be able to edit inline Twig templates in the WebformComputedTwig element and WebformEmailHandler with being granted permission.

Proposed resolution

Add 'edit webform twig' permission.

CommentFileSizeAuthor
#4 2932671-twig-permission-4.patch11.24 KBjrockowitz
#3 2932671-twig-permission-3.patch4.46 KBjrockowitz

Comments

jrockowitz created an issue. See original summary.

  • jrockowitz committed 61c75ac on 2932671-twig-permission 
    Issue #2932671: Add 'edit webform twig' permission
jrockowitz’s picture

jrockowitz commented
Status: Active » Needs review
StatusFileSize
new 2932671-twig-permission-3.patch4.46 KB
jrockowitz’s picture

jrockowitz commented
StatusFileSize
new 2932671-twig-permission-4.patch11.24 KB
jrockowitz’s picture

jrockowitz commented
Status: Needs review » Fixed

  • jrockowitz committed e764473 on 8.x-5.x 
    Issue #2932671 by jrockowitz: Add 'edit webform twig' permission

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.