ccswbs / hjckrrh

GNU General Public License v2.0
6 stars 5 forks source link

Remove access to ug_permit options #952

Closed tqureshi-uog closed 1 year ago

tqureshi-uog commented 1 year ago

The ug_permit module has serious security implications since clients can inadvertently grant Anonymous users the ability to update and delete content. Because the ug_permit module is a dependency for others, it cannot be disabled outright. An alternative solution is to remove the ability to set its permissions from all Drupal roles except the super user. To do this, the ug_role feature had to be updated. Once this change is merged, site managers, authors, and editors will no longer have access to the Permissions tab on the node edit screen.

mmafe commented 1 year ago

@tqureshi-uog I was able to remove the update and delete options from Anonymous users in the ug_permit module. Could this work: https://github.com/ccswbs/hjckrrh/pull/954

That way, existing users can still use the module (and deny anonymous users access to certain pages) but they're no longer able to give anonymous users the update and delete permission.