hi!,
workflow tab access is granted by function workflow_node_tab_access when:
- node type has a workflow associated, and
- user is in an allowed role established on /admin/build/workflow/edit/, or
- user can administer nodes
so, any user can access workflow history when has no view or update access to a node at all, simply typing the workflow history URL (/node//workflow)
I think it may supose a security issue in some cases. I made a simply patch for my site, may help someone in the same situation.
| Comment | File | Size | Author |
|---|---|---|---|
| #8 | 785194.patch | 1.3 KB | nancydru |
| wf_only_if_nodeaccess.patch | 597 bytes | manuel.adan |
Comments
Comment #1
arcall commentedadan,
It took me a while to find your post, but god, you saved mw a lot of time. It's working perfectly,
Thank you very much.
Comment #2
manuel.adanYou're wellcome arcall. Really this is a bug, anyone with edit workflow access has whole workflow access in the website.
Comment #3
manuel.adanNear three years later, this (security) bug is still open and patch not ported to dev branch...
Comment #4
nancydruEven though I am not working on the 6.x-1.x branch, I committed your patch (sorry, in the rush, I forgot the attribution).
If this could truly be considered a security fix, please see How to report a security issue.
Comment #5
nancydruCommitted to 7.x-1.x branch, with attribution.
Comment #6
tte commentedI don't think this is the right approach. In fact, it breaks (my) workflow functionality when following this "revisioning"/"workflow" model here: http://drupal.org/node/408052 (list item 8, 'important' notice).
Checking for additional "revisioning" related permissions isn't quite useful either, as you can use lots of individual permission sets, resulting in too many checks.
As an alternative, we could implement an additional "view workflow history" permission and only show the workflow tab, as long as this permission or the already existing "schedule workflow transitions" permission is set for the current user.
Comment #7
nancydruActually, you are right. On the workflow configuration, there is a section "Workflow tab permissions" that governs which nodes show the tab. In what way is that not an adequate solution already? This patch hits that same code.
Comment #8
nancydruThis is a patch for the 7.x branch, but should be fairly close to the 6.x code as well.
Comment #9
nancydruCommitted to both 6.x-1.x and 7.x-1.x