Lock the site down to authenticated users only
All the ledger data is confidential (real client names, amounts, associate balances) -- revoke 'access content' from the anonymous role so nodes, taxonomy terms, and JSON:API all deny anonymous reads (verified: JSON:API returns an empty data[] + "omitted" notice instead of the records, /lignes and /dashboard 403). Set the site's 403 page to /user/login: anonymous visitors hitting "/" (the front page is /lignes) land on the login form instead of an access-denied page; authenticated users still land on /lignes as before since they still hold 'access content' via the authenticated role. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
@@ -6,7 +6,7 @@ name: 'Figures Libres - Compta'
|
|||||||
mail: admin@example.com
|
mail: admin@example.com
|
||||||
slogan: ''
|
slogan: ''
|
||||||
page:
|
page:
|
||||||
403: ''
|
403: /user/login
|
||||||
404: ''
|
404: ''
|
||||||
front: /lignes
|
front: /lignes
|
||||||
admin_compact_mode: false
|
admin_compact_mode: false
|
||||||
|
|||||||
@@ -6,7 +6,6 @@ dependencies:
|
|||||||
- filter.format.restricted_html
|
- filter.format.restricted_html
|
||||||
module:
|
module:
|
||||||
- filter
|
- filter
|
||||||
- system
|
|
||||||
_core:
|
_core:
|
||||||
default_config_hash: Tus1ZTNXKIOnrennR1hnTbc7wUPBXHTUm5UdCpEhJSk
|
default_config_hash: Tus1ZTNXKIOnrennR1hnTbc7wUPBXHTUm5UdCpEhJSk
|
||||||
id: anonymous
|
id: anonymous
|
||||||
@@ -14,5 +13,4 @@ label: 'Anonymous user'
|
|||||||
weight: 0
|
weight: 0
|
||||||
is_admin: false
|
is_admin: false
|
||||||
permissions:
|
permissions:
|
||||||
- 'access content'
|
|
||||||
- 'use text format restricted_html'
|
- 'use text format restricted_html'
|
||||||
|
|||||||
Reference in New Issue
Block a user