Contrib.social

Views DisplayLink not properly checking access

Open on Drupal.org →
Created on 25 January 2023, over 1 year ago
Updated 9 February 2023, over 1 year ago

Problem/Motivation

When a view has multiple displays with different access requirements, the DisplayLink area plugin does not accurately check access.

Steps to reproduce

1. Create a view with multiple displays.
2. Override the second display to have a different permission requirement.
3. On the second display, add the DisplayLink plugin to the footer area, linking to the first display.
4. Log in as a user who can view the second display, but not the first.
5. The link will still be visible, pointing to a 403. It should be hidden instead.

Proposed resolution

Do proper access checking, hiding if not allowed.

🐛 Bug report
Status

Needs work

Version

10.1 ✨

Component
Views  →

Last updated about 5 hours ago

Created by

🇦🇺Australia Seth Hilder

Live updates comments and jobs are added and updated live.
  • Needs tests

    The change is currently missing an automated test that fails when run with the original code, and succeeds when the bug has been fixed.

Sign in to follow issues

Comments & Activities

  • Issue created by @Seth Hilder
  • Comment over 1 year ago →
    🇦🇺Australia Seth Hilder

    Patch to add a simple access check.

  • Status changed to Needs review over 1 year ago
  • Comment over 1 year ago →
    🇺🇸United States cilefen
  • Status changed to Needs work over 1 year ago
  • Comment over 1 year ago →
    🇳🇱Netherlands Lendude Amsterdam

    Nice find!

    Patch makes sense, needs automated test coverage though, so 'needs work' for that

  • Comment over 1 year ago →
    🇳🇱Netherlands Lendude Amsterdam

    Plugin seems to have nice dedicated coverage in \Drupal\Tests\views\Kernel\Handler\AreaDisplayLinkTest so should be extendable.

    Caching might get tricky though right? Since the cache context for the display link would depend on the access plugin used in the other display....hmm.

contrib.social Blog FAQ Discussions
Production build 0.69.0 2024