Sonataadminbundle: Child admins entities are accessible from any parent admin entities.

Created on 13 Jul 2017  路  1Comment  路  Source: sonata-project/SonataAdminBundle

Subject

When editing a child (or on any other child route) if you change the parent id there's no error.

In fact, there have never been any check that the child belong to the parent.

My first thought was this is a security issue due to the scope of this bug. I discussed with @greg0ire about it and we finally agreed that it is not.

Easy Pick bug

Most helpful comment

Still, getting a 404 for that would be nice.

>All comments

Still, getting a 404 for that would be nice.

Was this page helpful?
0 / 5 - 0 ratings