If the data export page has its access restricted (role or permission), and the user does not have such rights, the attachment link shown on another display, should not show. When the user clicks this attachment link they are correctly greeted with an access denied page. Typically with Drupal, if the user does not have access to a page then any link to it is removed.

CommentFileSizeAuthor
#6 link-access-1985960-6.patch2.76 KBguillaumev
#4 views-data-export-permission.jpg27.93 KBprdctvtxt
#4 link-access-1985960-4.patch1.13 KBprdctvtxt

Comments

steven jones’s picture

steven jones commented
Issue tags: +Needs tests

We should add a test to catch this one, should be simple enough.

I think we're just missing a call to some views access callback somewhere.

dpearcefl’s picture

dpearcefl commented

This problem also exists in the v6 release. Would like a patch for it also.

phily’s picture

phily
he/him
Primary language French
Location 🇪🇺🇫🇷 Paris, France
commented

pleeaaasseee do it, I'm not that good on modifying permissions on a module code ;-)
Thanks

prdctvtxt’s picture

prdctvtxt commented
Issue summary: View changes
Status: Active » Needs review
StatusFileSize
new link-access-1985960-4.patch1.13 KB
new views-data-export-permission.jpg27.93 KB

very basic access control in patch attached.

acbramley’s picture

acbramley commented
Status: Needs review » Needs work

The access check should check the access that is configured on the display

guillaumev’s picture

guillaumev commented
Status: Needs work » Needs review
StatusFileSize
new link-access-1985960-6.patch2.76 KB

Here is a patch that should fix it.

steven jones’s picture

steven jones commented
Status: Needs review » Fixed

Aces! Thanks so much for the patch.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.