When viewing a 'child-page' of a book, the link to go 'up' to it's parent page is always shown, even if the user has no access to that page. Clicking on that link will give a 403 page. Not dramatic, but still not nice. The 'previous' and 'next' links have proper access checks already.

Patch attached.

CommentFileSizeAuthor
#21 Screen Shot 2021-06-28 at 7.39.07 PM.png15.36 KBpameeela
#21 Screen Shot 2021-06-28 at 7.37.57 PM.png18.08 KBpameeela
#10 book_parent_access-428850-10.patch4.84 KBsmartinm
#8 book_parent_access_D8-428850-8.patch938 bytesbartlantz
#2 book-parent-access-428850-2-D6.patch1.12 KBpwolanin
boek-parent-1.patch1.01 KBdesbeers

Comments

pwolanin’s picture

pwolanin commented

The security team decided that this issue could be fixed in public since it's very minor.

pwolanin’s picture

pwolanin commented
StatusFileSize
new book-parent-access-428850-2-D6.patch1.12 KB

patch applies to D6 with fuzz - here's a clean version

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
commented

For D7, we're going to want some tests to validate that this doesn't recur. It'd in fact be good to test that an unpublished node doesn't occur in either the next, prev, OR up links.

gábor hojtsy’s picture

gábor hojtsy
he/him
Primary language Hungarian
Location Hungary
commented

Good idea to have this tested too.

pwolanin’s picture

pwolanin commented

sure, or in the list of child nodes

However, D7 node access queries have changed some, so test results will be a little irrelevant for D6 perhaps.

Status: Needs review » Needs work

The last submitted patch failed testing.

Anonymous’s picture

Anonymous (not verified) commented
Version: 7.x-dev » 8.x-dev
Issue tags: +Needs tests, +Novice

It looks like test coverage was never added to D7 for this.

bartlantz’s picture

bartlantz commented
Status: Needs work » Needs review
StatusFileSize
new book_parent_access_D8-428850-8.patch938 bytes

here's the patch in #2 rerolled for drupal 8. I'm working on a test for this too, should have that uploaded soon.

bartlantz’s picture

bartlantz commented

Also, I should add, I was able to reproduce this bug in Drupal 8. And after I applied the re-rolled patch in #8, the bug was fixed. I'm still working on the simpletest, that should be posted soon.

smartinm’s picture

smartinm commented
Assigned: desbeers » smartinm
StatusFileSize
new book_parent_access-428850-10.patch4.84 KB

This is my attempt at a patch for this issue:

  • Re-rolled the original patch for D8.
  • Added testBookNodeAccess to test that a private node doesn't occur in either the next, previous, up or the list of child links.
  • Changed current tests to use variable_set('node_access_test_private', TRUE); like in others node access tests (ForumNodeAccessTest, TrackerNodeAccessTest,...) instead of give anonymous users the permission 'node test view'.

This change is needed to test private node access. This also fixes testBookExport() bug in "Anonymous user is not shown link to printer-friendly version", in current implementation assertNoLink() will always evaluate to true because the response is 403.

socketwench’s picture

socketwench commented
Assigned: smartinm » Unassigned
Issue summary: View changes
Issue tags: -Novice

Novice issue cleanup.

pwolanin’s picture

pwolanin commented
Status: Needs review » Needs work

Almost certainly doesn't apply now.

Version: 8.0.x-dev » 8.1.x-dev

Drupal 8.0.6 was released on April 6 and is the final bugfix release for the Drupal 8.0.x series. Drupal 8.0.x will not receive any further development aside from security fixes. Drupal 8.1.0-rc1 is now available and sites should prepare to update to 8.1.0.

Bug reports should be targeted against the 8.1.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.2.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.1.x-dev » 8.2.x-dev

Drupal 8.1.9 was released on September 7 and is the final bugfix release for the Drupal 8.1.x series. Drupal 8.1.x will not receive any further development aside from security fixes. Drupal 8.2.0-rc1 is now available and sites should prepare to upgrade to 8.2.0.

Bug reports should be targeted against the 8.2.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.3.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.2.x-dev » 8.3.x-dev

Drupal 8.2.6 was released on February 1, 2017 and is the final full bugfix release for the Drupal 8.2.x series. Drupal 8.2.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.3.0 on April 5, 2017. (Drupal 8.3.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.3.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.3.x-dev » 8.4.x-dev

Drupal 8.3.6 was released on August 2, 2017 and is the final full bugfix release for the Drupal 8.3.x series. Drupal 8.3.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.4.0 on October 4, 2017. (Drupal 8.4.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.4.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.4 was released on January 3, 2018 and is the final full bugfix release for the Drupal 8.4.x series. Drupal 8.4.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.5.0 on March 7, 2018. (Drupal 8.5.0-alpha1 is available for testing.)

Bug reports should be targeted against the 8.5.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.6 was released on August 1, 2018 and is the final bugfix release for the Drupal 8.5.x series. Drupal 8.5.x will not receive any further development aside from security fixes. Sites should prepare to update to 8.6.0 on September 5, 2018. (Drupal 8.6.0-rc1 is available for testing.)

Bug reports should be targeted against the 8.6.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.6.x-dev » 8.8.x-dev

Drupal 8.6.x will not receive any further development aside from security fixes. Bug reports should be targeted against the 8.8.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.9.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.7 was released on June 3, 2020 and is the final full bugfix release for the Drupal 8.8.x series. Drupal 8.8.x will not receive any further development aside from security fixes. Sites should prepare to update to Drupal 8.9.0 or Drupal 9.0.0 for ongoing support.

Bug reports should be targeted against the 8.9.x-dev branch from now on, and new development or disruptive changes should be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

pameeela’s picture

pameeela commented
Issue summary: View changes
Status: Needs work » Closed (cannot reproduce)
Issue tags: +Bug Smash Initiative
StatusFileSize
new Screen Shot 2021-06-28 at 7.37.57 PM.png18.08 KB
new Screen Shot 2021-06-28 at 7.39.07 PM.png15.36 KB

I can't reproduce this anymore. Steps to test:

  1. Create a book page and use it to create a new book
  2. Add some child pages
  3. View the child pages as anonymous user, see there is an 'Up' link
  4. Unpublish the parent page and view the child pages, see the 'Up' link no longer displays

Parent page published:

Parent page unpublished:

I'm not sure what other method could be used for controlling access besides published/unpublished. If anyone can reproduce this still, please update the issue summary with the steps and set the issue back to 'Active'.