Views DisplayLink not properly checking access

Created on 25 January 2023, about 2 years ago

Updated 9 February 2023, about 2 years ago

Problem/Motivation

When a view has multiple displays with different access requirements, the DisplayLink area plugin does not accurately check access.

Steps to reproduce

1. Create a view with multiple displays.
2. Override the second display to have a different permission requirement.
3. On the second display, add the DisplayLink plugin to the footer area, linking to the first display.
4. Log in as a user who can view the second display, but not the first.
5. The link will still be visible, pointing to a 403. It should be hidden instead.

Proposed resolution

Do proper access checking, hiding if not allowed.

🐛 Bug report

Status

Needs work

Version

10.1 ✨

Component

Views →

Last updated about 7 hours ago

Maintained by
🇩🇪Germany @dawehner
🇺🇸United States @tim.plunkett
🇬🇧United Kingdom @damiankloip
🇺🇸United States @xjm
🇳🇱Netherlands @Lendude

Created by

🇦🇺Australia Seth Hilder

Live updates comments and jobs are added and updated live.

Needs tests
The change is currently missing an automated test that fails when run with the original code, and succeeds when the bug has been fixed.

Comments & Activities

Issue created by @Seth Hilder
Comment about 2 years ago →
🇦🇺Australia Seth Hilder
Patch to add a simple access check.
Status changed to Needs review about 2 years ago12:24pm 25 January 2023
Comment about 2 years ago →
cilefen
Status changed to Needs work about 2 years ago2:49pm 9 February 2023
Comment about 2 years ago →
🇳🇱Netherlands Lendude Amsterdam
Nice find!

Patch makes sense, needs automated test coverage though, so 'needs work' for that
Comment about 2 years ago →
🇳🇱Netherlands Lendude Amsterdam
Plugin seems to have nice dedicated coverage in \Drupal\Tests\views\Kernel\Handler\AreaDisplayLinkTest so should be extendable.

Caching might get tricky though right? Since the cache context for the display link would depend on the access plugin used in the other display....hmm.

contrib.social Blog FAQ Discussions

Production build 0.71.5 2024