Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.While developping #371769: allow for n to n and typed user/client relationships, we noticed an inconsistency in the access controls for the site creation form that is in a tab of the Client node type. Basically, there are no access controls there. I can freely create a site for any Client as long as I'm logged in as a client that has the "create site" permission.
This obviously needs to be fixed before release.
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | client_access.patch | 838 bytes | anarcat |
Comments
Comment #1
anarcat commentedThe problem is that there is not access check in the form itself. I confirm the issue by more formal testing: my "anarcat" user only has access to the "anarcat" client and was able to create a site in the "admin" client.
Comment #2
anarcat commentedComment #3
anarcat commentedSo here's my stab at this. I'm quite confused by all of this so I would appreciate adrian's eyeballs on this.
Comment #4
anarcat commentedFixed in my last commit. There was no access control on the form...