Attached is a patch which makes views check that a user should have access to the display before rending block contents.

Page displays do this through the menu system, but without this patch views can't provide access control for blocks using this same extensible system.

Comments

jmiccolis’s picture

StatusFileSize
new1.24 KB

It looks like my original patch was doing more work that it needed to. Simpler patch attached.

merlinofchaos’s picture

Status: Needs review » Needs work

Hmm. $view->access() is already being tested in views_block prior to the execute_display() call there. In general I've preferred keeping access tests external, though for pages they became internal so that we could have multiple displays with the same path and it needed to move into the view for that. I don't see why we should check twice.

jmiccolis’s picture

Status: Needs work » Closed (fixed)

Yep, I stand corrected. Thanks.