Problem/Motivation

I think "Administer content" permission should not be used on a UI that is not related to content anyhow. If the Lagoon logs UI would also allow changing configuration, not just viewing them, this could be a security issue. Currently, it only exposes information that possibly cannot be leveraged anyhow, this is the reason why I am reporting this here.

https://git.drupalcode.org/project/lagoon_logs/-/blob/8.x-1.1/lagoon_log...

Steps to reproduce

Ideas:
* Introduce a dedicated permissions
* Move this information to the admin/reports/status page

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork lagoon_logs-3240629

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

mxr576 created an issue. See original summary.

Kristen Pol’s picture

Kristen Pol
she/her
Primary language English
Location Santa Cruz, CA, USA
CreditAttribution: Kristen Pol at Itty Bitty Byte for Salsa Digital commented

I agree with this. I was surprised by this permission being used and was going to create an issue if there wasn't already one. But here it is :)

Easy fix could be to at least change this to Administer site configuration for now.

bomoko’s picture

bomoko CreditAttribution: bomoko at amazee.io commented

Yeah, I think this was probably a copy-pasta issue in the early early dev of this module - we actually has a settings page that allowed some config settings, but it was scrapped, and this page and route is a kind of vestigial artifact.

Totally agree, though - I think just changing to Administer Site Configuration is the simplest.

bomoko opened merge request !4

bomoko closed merge request !4

bomoko opened merge request !5

bomoko opened merge request !6

  • bomoko committed 9ea2f8e on 8.x-1.x 
    Issue #3240629 by bomoko, mxr576, Kristen Pol: Change access to Lagoon...
bomoko’s picture

bomoko CreditAttribution: bomoko at amazee.io commented

Thanks all - I'll consider this closed for the moment with the Perms update.

bomoko’s picture

bomoko CreditAttribution: bomoko commented
Status: Active » Fixed
Kristen Pol’s picture

Kristen Pol
she/her
Primary language English
Location Santa Cruz, CA, USA
CreditAttribution: Kristen Pol at Itty Bitty Byte for Salsa Digital commented

Fast! Thanks :)

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.