Quantcast
Channel: Issues for Drupal core
Viewing all articles
Browse latest Browse all 291574

Users with "configure any layout" can see entities they don't have "view" access to

$
0
0

I filed this issue has a security issue first and got the ok to file it as a public issue since the configure any layout permission is a restrict access permission. @see https://www.drupal.org/drupal-security-team/security-advisory-process-an...

Problem/Motivation

Steps to reproduce
1. Install the Layout Builder module and enable defaults and overrides for the article content type
2. Create a unpublished article node
2. Login as user with "configure any layout" permission
3. View node view page node/1
4. Get "access denied"
5. Go to node/1/layout

Expected result:
403
Actual result:
The Layout Builder representation of the node, with all field values displayed

Proposed resolution

User must have View access to an entity to create/update a layout override.

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet


Viewing all articles
Browse latest Browse all 291574

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>