Problem/Motivation

Since disclosure is no longer a security issue - I'll report the issue here

URL of Paragraph Browser (path: '/paragraphs_browser/{field_config}/{paragraphs_browser_type}/{uuid}') is accessible as an anon user because it has permissions "_permission: 'access content'" which is everybody

It will disclose which paragraph are available to be added etc
It should return 403 access denied.

Steps to reproduce

navigate to '/paragraphs_browser/{field_config}/{paragraphs_browser_type}/{uuid}'

Proposed resolution

Add a new permission "access paragraph browser" which should be assigned to all users who are allowed to view it

Remaining tasks

User interface changes

API changes

Data model changes

Comments

jannakha created an issue. See original summary.

damienmckenna’s picture