Prevent permission "Administer Comment Notify" from being granted to anonymous user

Created on 7 October 2023, 9 months ago
Updated 7 May 2024, about 2 months ago

Problem/Motivation

It's currently possible to grant the permission, "Administer Comment Notify" to the anonymous user. This is both a usability issue and security risk.

Steps to reproduce

  1. Grant the anonymous user role permission to "Administer Comment Notify"
  2. Visit the Comment Notify configuration page anonymously.
  3. Change some settings.

Proposed resolution

In Drupal 7 there is a parameter in hook_permission() has a 'restrict access' key. โ†’ TBD if there is an equivalent method in Drupal 8+

Remaining tasks

  1. โŒ Get maintainer approval for this feature
  2. โŒ Implement feature request
  3. โŒ Test

User interface changes

"Administer Comment Notify" permission checkbox is disabled for anonymous users.

API changes

None

Data model changes

None

โœจ Feature request
Status

Active

Version

1.0

Component

Code

Created by

๐Ÿ‡บ๐Ÿ‡ธUnited States cedewey Denver, CO

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @cedewey
  • ๐Ÿ‡บ๐Ÿ‡ธUnited States greggles Denver, Colorado, USA

    The restrict access flag (which I believe exists in 8+ as well) is for marking permissions that are inherently dangerous. Administering text formats inherently allows someone with that permission to take over the site (see filter/filter.permissions.yml), while administer taxonomy is important but is not marked with restrict access as it doesn't inherently allow taking over a site (see taxonomy/taxonomy.permissions.yml).

  • ๐Ÿ‡ฎ๐Ÿ‡ณIndia dev16.addweb

    silvi.addweb โ†’ made their first commit to this issueโ€™s fork.

  • ๐Ÿ‡บ๐Ÿ‡ธUnited States greggles Denver, Colorado, USA

    I think this should be marked as "Closed - works as designed".

Production build 0.69.0 2024