acquia/reservoir

Protect the /admin/api/advanced route

CashWilliams opened this issue 7 years ago · 2 comments

CashWilliams commented 7 years ago

Currently the reservoir_ui.api.advanced route is open to the public due to https://github.com/acquia/reservoir/blob/8.x-1.x/modules/reservoir_ui/reservoir_ui.routing.yml#L41

CashWilliams commented 7 years ago

Note: This is a security issue, but since there is not a stable release, the module/profile is not covered by the Drupal Security Team.

tedbow commented 7 years ago

@CashWilliams thanks created a PR