Insufficient permission check for toolbar integration

Created on 17 July 2025, 11 days ago

Problem/Motivation

The toolbar integration doesn't sufficiently check whether the user has the "See all environment indicators" permission. If the user doesn't have the permission, it hides the environment name, but the toolbar color will still be changed.

Steps to reproduce

1. Install environment_indicator, environment_indicator_toolbar and environment_indicator_ui
2. Define a name and background color for the current environment (at /admin/config/development/environment-indicator/current)
3. Assign the "Use toolbar" permission to anonymous users (just for the sake of an example - it works with any role)
4. As anonymous user, visit the page β†’ The toolbar will have the defined background color, although the anonymous users do not have the "See all environment indicators" permission.

Proposed resolution

Add a permission check to ensure the toolbar color is only changed if the current user has the "See all environment indicators" permission

Remaining tasks

Implement a fix

User interface changes

Toolbar color only changes if user has sufficient permission

API changes

None

Data model changes

None

πŸ› Bug report
Status

Active

Version

4.0

Component

Code

Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.71.5 2024