Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CMSPageHistoryViewerController doesn't try to block you from viewing a page you do not have read access on #216

Open
maxime-rainville opened this issue Jun 27, 2021 · 0 comments
Open

CMSPageHistoryViewerController doesn't try to block you from viewing a page you do not have read access on #216

maxime-rainville opened this issue Jun 27, 2021 · 0 comments
Labels
affects/v4 complexity/low impact/low type/bug Something isn't working

Comments

@maxime-rainville
Copy link
Contributor

Steps to reproduce

  • You are logged in with a non-admin user
  • There's a page you do not have read access on
  • You attempt to acces the page history by manually typing its URL (e.g.: /admin/pages/history/show/3)

Expected results: You get refuse access with a 403 error
Actual: CMSPageHistoryViewerController attempts to fulfil your request and throws a 500 error when it tries to call a method on a null form object.

image
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
affects/v4 complexity/low impact/low type/bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@bergice @maxime-rainville @emteknetnz