Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.I create a view with the bulk operations style and it works fine. However when I logout the actions, which should otherwise be restricted (e.g. delete node) still show up and anonymous users have access to them. Is this a security hole or I am missing something?
What I am trying to achieve is to have a view that displays the bulk operations to those with proper permissions (e.g. node authors) and use the same view to display information to anonymous users but without the ability to edit/delete/etc.
Comments
Comment #1
infojunkieIn Drupal, there is no permission system associated with specific actions. Permissions are associated with pages (nodes, views, admin screens, etc.) So VBO has no way to selectively disable actions based on who's viewing. On the other hand, you can specify permissions for the view as a whole. Perhaps you could create several versions of the view for different user roles, and use a little redirection hack to choose the right view for the viewer's role.
Comment #2
pasqualleThe operations should have access settings.
I can understand why there is no permission system associated with actions. Actions were not designed to be exposed to users. They run in background when something happens.
But this module still needs access check for the exposed actions. Creating several version of the same view (or same view display) does not work, as for example with 5 actions (with specific access) you need to create (2^5) 32 views..
Comment #3
infojunkieThe latest dev version of VBO contains a module called actions_permissions. It creates an "Execute action" user permission for each action it finds, and VBO uses it to restrict access to actions. I'd be happy if you could try it out.
Comment #4
pasqualleI had to reedit the "Selected operations" in all my vbo views, but after that it seems to work correctly.. thanks
an update function would be nice..
and I noticed that the actions are not ordered alphabetically in the views setting, so it is quite challenging to match with the related permission which is ordered..
Comment #5
infojunkieThanks for your feedback. I fixed the sorting on the views settings.
I will mark this as fixed for now. Feel free to open a new issue concerning the module update.