From f8ae2d6a9e01cbe48696373361059a9ab4e05ac0 Mon Sep 17 00:00:00 2001 From: bach Date: Fri, 4 Sep 2026 10:57:18 +0200 Subject: [PATCH] Lock the site down to authenticated users only All the ledger data is confidential (real client names, amounts, associate balances) -- revoke 'access content' from the anonymous role so nodes, taxonomy terms, and JSON:API all deny anonymous reads (verified: JSON:API returns an empty data[] + "omitted" notice instead of the records, /lignes and /dashboard 403). Set the site's 403 page to /user/login: anonymous visitors hitting "/" (the front page is /lignes) land on the login form instead of an access-denied page; authenticated users still land on /lignes as before since they still hold 'access content' via the authenticated role. Co-Authored-By: Claude Sonnet 5 --- config/sync/system.site.yml | 2 +- config/sync/user.role.anonymous.yml | 2 -- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/config/sync/system.site.yml b/config/sync/system.site.yml index 14354be..7b2a93a 100644 --- a/config/sync/system.site.yml +++ b/config/sync/system.site.yml @@ -6,7 +6,7 @@ name: 'Figures Libres - Compta' mail: admin@example.com slogan: '' page: - 403: '' + 403: /user/login 404: '' front: /lignes admin_compact_mode: false diff --git a/config/sync/user.role.anonymous.yml b/config/sync/user.role.anonymous.yml index 90f287d..69342ad 100644 --- a/config/sync/user.role.anonymous.yml +++ b/config/sync/user.role.anonymous.yml @@ -6,7 +6,6 @@ dependencies: - filter.format.restricted_html module: - filter - - system _core: default_config_hash: Tus1ZTNXKIOnrennR1hnTbc7wUPBXHTUm5UdCpEhJSk id: anonymous @@ -14,5 +13,4 @@ label: 'Anonymous user' weight: 0 is_admin: false permissions: - - 'access content' - 'use text format restricted_html'