By amateescu on
Change record status:
Published (View all published change records)
Project:
Introduced in branch:
8.3.x
Introduced in version:
8.3.0-rc1
Issue links:
Description:
The 'Label' formatter for entity reference fields has been updated to use the new 'view label' entity access operation.
The effect of this change for existing sites is that usernames are now displayed to all users, including those that do not have the 'access user profiles' permission.
According to the current Drupal security policy, displaying usernames to all users is not considered a weakness: https://www.drupal.org/node/1004778.
See https://www.drupal.org/node/2661092 for more information about the new 'view label' entity access operation.
Impacts:
Site builders, administrators, editors
Module developers
