When I am logged in with a user that can view unpublished content, it will display links to unpublished content in the footermap block. Generally when you unpublish a node, you don't remove the menu link or disable the link either, you can simply unpublish it and it will get removed from menus by default. However, footermap still includes links to unpublished content.

Then because the caching doesn't take user roles into account, these links can get cached and unpublished content is displayed to users that it shouldn't be displayed to. The caching should take node access into account and from a quick view of the caching, it looks like it only looks at the language.

Comments

badjava created an issue. See original summary.

mradcliffe’s picture

Thanks for the bug report.

I need to back port the changes I made in Drupal 8 so that the footermap is always generated based on the anonymous user.

mradcliffe’s picture

Status: Active » Needs review
StatusFileSize
new3.97 KB
new3.19 KB

Here's a patch. First patch is test only.

I had a note about scope of access in this module before so I went ahead and kept this issue public.

The last submitted patch, 3: footermap-2885604-use-anonymous-user-3-test-only.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

mradcliffe’s picture

git show fail.

Status: Needs review » Needs work

The last submitted patch, 5: 2885604-footermap-use-anonymous-user-5.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

mradcliffe’s picture

Status: Needs work » Closed (outdated)

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.