Quantcast
Channel: Issues for Drupal core
Viewing all articles
Browse latest Browse all 299067

Delete confirm form for locked fields is hotlinkable

$
0
0

Updated: Comment #0

Problem/Motivation

Locked fields don't show a 'delete field' link in the field ui however the url for the confirm form can still be navigated to via hotlinking (although the submit handler doesn't delete the field).

Proposed resolution

Add an access check for the route to return access denied for locked fields

Remaining tasks

  • Tests
  • Fix

User interface changes

None

API changes

None


Viewing all articles
Browse latest Browse all 299067

Latest Images

Trending Articles



Latest Images

<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>