Domain Login Restrict
The module does not sufficiently enforce login restrictions when a user logs in by a method other than the standard login form. An ordinary account on the site could view restricted information and alter or add new data.
- Who could do thisOnly someone with a login on your site.
- Does it apply to youAn attacker must have a valid user account on the site, the enable restriction setting must be enabled on the Domain settings page, and the user must not have the access right to log in to any domain.
- Has it been used in attacksNo sign of it.
- How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.
Tell your developerUpdate Domain Login Restrict to 8.x-1.5.
For developers: what the fix changed
The fix updates the domain_login_restrict_user_login function in domain_login_restrict.module to enforce login restrictions on all paths. It achieves this by checking the domain access of the user, invalidating the session, and throwing an access denied exception if the login is not permitted.
Also in this release The release also updates the README file with new PHP and Drupal version requirements and documentation on which logins are checked.
README.md+18 −2domain_login_restrict.module+107 −80 fix