Contrib.social

Unprivileged users can add Layout Builder sections in 2.2.0

Open on Drupal.org →
Created on 17 June 2025, 15 days ago

Problem/Motivation

In layout_builder_perms version 2.2.0, users without the required specific permission are still able to add new sections to Layout Builder layouts. They can successfully click "Add section" and select a layout. However, after adding the section, they are unable to edit or remove it, as expected, due to missing the corresponding "edit" or "remove" permissions.

This is a security vulnerability as it grants unauthorized content modification capabilities.

Steps to reproduce

  1. Install Drupal: Fresh Drupal 8/9/10 installation.
  2. Enable Modules: layout_builder, layout_discovery, and layout_builder_perms (version 2.2.0).
  3. Configure Layout Builder:
    • Go to Structure > Content types > [Your content type, e.g., Basic page] > Manage display.
    • Enable "Use Layout Builder" and "Allow each content item to have its layout customized."
  4. Create a Role:
    • Go to People > Roles.
    • Add a new role (e.g., "Layout Test User").
  5. Assign Permissions:
    • Go to People > Permissions.
    • Assign the "Layout Test User" role ONLY the following permissions (ensure no other Layout Builder related permissions are granted, especially not generic "Administer Layout Builder" or "Use Layout Builder" permissions if they exist):
      • View published content
      • Access content
      • (Optionally, for testing section_edit and section_remove later, but for this bug, ensure they do NOT have: add layout_onecol layouts on basic_page node entities or similar permissions for adding sections)
  6. Create a User:
    • Create a new user (e.g., testuser).
    • Assign the "Layout Test User" role to this user.
  7. Log in: Log in as testuser.
  8. Attempt to add a section:
    • Create a new content item (e.g., a Basic Page).
    • Go to the "Layout" tab.
    • Click the "Add section" button.
    • Choose any available layout (e.g., "One column").
🐛 Bug report
Status

Active

Version

2.2

Component

Code

Created by

mrwhittaker

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024