Lock the site down to authenticated users only
All the ledger data is confidential (real client names, amounts, associate balances) -- revoke 'access content' from the anonymous role so nodes, taxonomy terms, and JSON:API all deny anonymous reads (verified: JSON:API returns an empty data[] + "omitted" notice instead of the records, /lignes and /dashboard 403). Set the site's 403 page to /user/login: anonymous visitors hitting "/" (the front page is /lignes) land on the login form instead of an access-denied page; authenticated users still land on /lignes as before since they still hold 'access content' via the authenticated role. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
@@ -6,7 +6,7 @@ name: 'Figures Libres - Compta'
|
||||
mail: admin@example.com
|
||||
slogan: ''
|
||||
page:
|
||||
403: ''
|
||||
403: /user/login
|
||||
404: ''
|
||||
front: /lignes
|
||||
admin_compact_mode: false
|
||||
|
||||
@@ -6,7 +6,6 @@ dependencies:
|
||||
- filter.format.restricted_html
|
||||
module:
|
||||
- filter
|
||||
- system
|
||||
_core:
|
||||
default_config_hash: Tus1ZTNXKIOnrennR1hnTbc7wUPBXHTUm5UdCpEhJSk
|
||||
id: anonymous
|
||||
@@ -14,5 +13,4 @@ label: 'Anonymous user'
|
||||
weight: 0
|
||||
is_admin: false
|
||||
permissions:
|
||||
- 'access content'
|
||||
- 'use text format restricted_html'
|
||||
|
||||
Reference in New Issue
Block a user