Bulk Update User Roles
The bulk update form does not stop users who lack the right to assign roles from using it. Someone with the right to manage users could assign roles they should not be able to and change or add data. They could not do this without the right to manage users.
- Who could do thisOnly someone with an administrator login.
- Does it apply to youAn attacker has an account with the access right to administer users.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Bulk Update User Roles to 1.0.5.
For developers: what the fix changed
The fix updates the routing requirement in bulk_update_user_roles.routing.yml to require the 'administer permissions' permission instead of 'administer users'. It also updates BulkUpdateUserForm.php to filter the assignable roles based on the current user's permissions in getAssignableRoles() and validates the selected roles during form submission in submitForm().
bulk_update_user_roles.routing.yml+1 −1 fixsrc/Form/BulkUpdateUserForm.php+56 −15 fix