Users with "bypass vapn" permission don't actually bypass

Created on 20 July 2021, almost 3 years ago
Updated 21 April 2023, about 1 year ago

Problem/Motivation

The "bypass vapn" permission was added in ticket #3099467: Added "bypass vapn"-permisson β†’ This removes bypassing roles from the roles to select for giving view access on a node form. However, there is no logic to actually ALLOW those roles to see restricted nodes.

Steps to reproduce

- Create a role without "bypass node access" that has the "bypass vapn" permission
- Edit a node and check a box under the VAPN settings to limit view access of that node to another named role.
- Attempt to view the node with a user who has the bypass vapn permission and get access denied.

Proposed resolution

Add roles with the "bypass vapn" permission to the allowed roles in vapn_node_access(). Patch forthcoming.

πŸ› Bug report
Status

Needs review

Version

1.5

Component

Code

Created by

πŸ‡ΊπŸ‡ΈUnited States jastraat

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.69.0 2024