Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.the "control panel" link in the navigation menu is displayed (if enabled) to every users, including anonymous.
i think the link display should be restricted to users having "access administration pages" permission, as the control panel is a front end to navigate in them.
patch is attached to add the check, tested for both 4.6 and HEAD versions (quickly, so i let the code needs review).
thanks
| Comment | File | Size | Author |
|---|---|---|---|
| cp-access-fix_0.patch | 752 bytes | syllance |
Comments
Comment #1
dreed47 commentedThanks for the patch syllance.
I'm not sure I want to address this issue by restricting the panel to only users with "access administration pages" permissions. The reason being that one might conceive of a situation where you may want to use the control panel for something other than the admin pages. That's easy enough to do as they can just change the "Control Panel menu path:" in settings to any menu path they want. I can't think of a good use case for this but that doesn't mean that one doesn't exist.
We could change it to only show for authenticated users but again, we're making some assumptions about it's use that might not be valid. If anyone is using the control panel their default admin page and they are using the HEAD or 4.6 patch then I would recommend that the control panel menu entry be disabled as it's really not needed.
The panel will only show items the user has access to. An option may be to not show then menu option if the user does not have access to any of the control panel items. I'm not sure of an easy way to do this but it might be possible.
Comment #2
dreed47 commentedProbably creating a new permission just for accessing the control panel may make the most sense. Then people can assign it any what they want.
Comment #3
dreed47 commentedadded a new 'access control panel' permissions
Comment #4
syllance commentedquickly tested and approved :)
i've just kept in mind the admin target, but your module could indeed be used for other things, and the update you made is fine.
let me avoid saying thanks once again, i'll just say "well done" ;)
Comment #5
(not verified) commented