Drupal's Security Review module recommends that "all Views implement some amount of access control, at a minimum checking for the permission 'access content'".

However, for views identified as 'default', when Access is changed from Restricted to 'Permissions/access content' while the settings show correctly when the view is updated, the change is lost when the view is saved.

Comments

dawehner’s picture

dawehner
Primary language German
commented
Status: Active » Fixed

Update to the dev version of views, it's fixed there already.

geoffb’s picture

geoffb commented

Brilliant. Thanks for the tip dereine.

- Geoff

geoffb’s picture

geoffb commented

FYI, I just updated to Views 6.x-3.x-dev but changing access from Restricted to 'Permissions/access content' is still not "sticking" after a save.

merlinofchaos’s picture

merlinofchaos commented

This happens because the access type and access settings got out of sync in a previously buggy version of Views. You can work around this by setting your display to override/not override, saving, and then setting it back. This will sync the settings back up. You may need to do this for each display that has overridden access settings.

liquidcms’s picture

liquidcms commented
Status: Fixed » Active

is this same issue? i can't seem to set overriden roles for access without it affecting the default values.

i have done what is suggested in #4 to set display access values to use default, saved, set to override, updated, saved

then change values on display and update.. and when i check default values they have changed to match what i just set in my overriden display.

i have latest -dev from today

liquidcms’s picture

liquidcms commented
Version: 6.x-3.0-alpha3 » 6.x-3.x-dev
liquidcms’s picture

liquidcms commented
Status: Active » Fixed

perhaps my issue is different so i'll set this back to fixed an open a new issue.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.