When we moved to declaring all the dependencies explicitly that was to avoid any script being added to the page while it didn't belong.

Right now going to the empty frontpage as anon will not have any JS but it will have JS settings added to the page as well.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

nod_’s picture

#1991684: Node history markers (comment & node "new" indicator, "x new comments" links) forces render caching to be per user introduced the regression.

/**
 * Implements hook_page_build().
 */
function user_page_build(&$page) {
  $path = drupal_get_path('module', 'user');
  $page['#attached']['css'][$path . '/css/user.module.css'] = array('every_page' => TRUE);

  // Provide the user ID in drupalSettings to allow JavaScript code to customize
  // the experience for the end user, rather than the server side, which would
  // break the render cache.
  global $user;
  $page['#attached']['js'][] = array(
    'type' => 'setting',
    'data' => array('user' => array(
      'uid' => $user->id(),
    )),
  );
}

Because something is added to the settings array that and do so through drupal_add_js(), the settings array will be added. It doesn't make sense to use a library for the settings here.

It's not too bad since drupalSettings depends on nothing but it still makes the browser run the JS thing for a page that shouldn't need it.

nod_’s picture

Status: Active » Needs review
FileSize
1.15 KB

For settings we should use alter since we're able to check if there actually are settings for the page.

Wim Leers’s picture

Title: drupalSettings is added to the page even if there is no other JS » drupalSettings.user.uid added to page even if there is no other JS; drupal.node-new-comments-link lib added for anon users
Assigned: Unassigned » Wim Leers
Issue tags: +Performance, +JavaScript, +sprint, +Spark
FileSize
2.05 KB

So I helped fix it and now I broke it! :( Ironic, isn't it?

I'm afraid the patch is quite wrong and badly breaks things: the structure of $javascript in hook_js_alter() is not quite what one would expect! I fixed that.
Also: that's not the only cause for JS to show up for anonymous users: the drupal.node-new-comments-link is also inappropriately added for anonymous users! Fixed that too.
Finally: the check for $javascript['settings'] is now clearly documented, so that others may understand it too without having to understand every part of the system.

Let's prevent this from ever happening again: #2120457: Add test to guarantee that the Standard profile does not load any JavaScript for anonymous users on critical pages.

Status: Needs review » Needs work

The last submitted patch, fix_no_js_anon-2120117-3.patch, failed testing.

Wim Leers’s picture

Status: Needs work » Needs review
FileSize
2.05 KB
2.06 KB

Oops, uploaded the interdiff as the patch. Let's do that better now.

nod_’s picture

Can't you add the permission for anon to comment as well, the isAuthenticated() might get in the way?

Wim Leers’s picture

#6: history module does not have any permissions; since all anonymous users in Drupal have the same user ID, there's no way to keep track of what they have and haven't read. So: no.

nod_’s picture

Right it's not for posting a new comment, my bad.

nod_’s picture

Status: Needs review » Reviewed & tested by the community

aannnd after testing, that works.

nod_’s picture

catch’s picture

Status: Reviewed & tested by the community » Fixed

Committed/pushed to 8.x, thanks!

Let's get that test in quick as well so this doesn't happen again :p

Wim Leers’s picture

Issue tags: -sprint

Indeed :D

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.