Quantcast
Channel: Issues for Drupal core
Viewing all articles
Browse latest Browse all 297408

Implement a tamper-proof hash for the media library state

$
0
0

Problem/Motivation

From #2983179-16: [META] Implement stricter access checking for the media library:

Right now, the media library depends on a state value object derived from URL query parameters. Users are not supposed to tamper with those parameters, but we have no mechanism in place to prevent that. So we need to implement a tamper-proof hash, similar to what Media does in its IframeUrlHelper class, to prevent people from messing with the query parameters in the first place.

Proposed resolution

Implement a tamper-proof hash, similar to what Media does in its IframeUrlHelper class, to prevent people from messing with the query parameters.

Remaining tasks

Write patch
Review
Commit

User interface changes

None

API changes

None

Data model changes

None

Release notes snippet


Viewing all articles
Browse latest Browse all 297408

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>