[6.x] Fix entry revision localizations to filter unauthorized sites#14714
Open
duncanmcclean wants to merge 1 commit into
Open
[6.x] Fix entry revision localizations to filter unauthorized sites#14714duncanmcclean wants to merge 1 commit into
duncanmcclean wants to merge 1 commit into
Conversation
The revision preview endpoint was exposing all collection sites in the localizations array regardless of user permissions. This allowed users with restricted site access to view unauthorized site details in the API response. Apply the same authorization filtering used in EntriesController by adding getAuthorizedSitesForCollection() to filter sites based on the current user's view permissions. Fixes #14697 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
duncanmcclean
force-pushed
the
fix/entry-revision-localizations-authorization
branch
from
b9467f5 to
da7ace0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request fixes an issue where the entry revision preview endpoint exposed all collection sites in the localizations array, regardless of user permissions. This allowed users with restricted site access to view site details they shouldn't have access to.
This was happening because
EntryRevisionsController::show()was building the localizations list directly from$entry->collection()->sites()without applying authorization checks.This PR fixes it by adding the
getAuthorizedSitesForCollection()method (matching the pattern already used inEntriesController) to filter sites based on whether the current user can view each site.Fixes #14697