Skip to content

CMSPageHistoryViewerController doesn't try to block you from viewing a page you do not have read access on #216

@maxime-rainville

Description

@maxime-rainville

Steps to reproduce

  • You are logged in with a non-admin user
  • There's a page you do not have read access on
  • You attempt to acces the page history by manually typing its URL (e.g.: /admin/pages/history/show/3)

Expected results: You get refuse access with a 403 error
Actual: CMSPageHistoryViewerController attempts to fulfil your request and throws a 500 error when it tries to call a method on a null form object.

image

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions