When I am logged in with a user that can view unpublished content, it will display links to unpublished content in the footermap block. Generally when you unpublish a node, you don't remove the menu link or disable the link either, you can simply unpublish it and it will get removed from menus by default. However, footermap still includes links to unpublished content.
Then because the caching doesn't take user roles into account, these links can get cached and unpublished content is displayed to users that it shouldn't be displayed to. The caching should take node access into account and from a quick view of the caching, it looks like it only looks at the language.
Comments
Comment #2
mradcliffeThanks for the bug report.
I need to back port the changes I made in Drupal 8 so that the footermap is always generated based on the anonymous user.
Comment #3
mradcliffeHere's a patch. First patch is test only.
I had a note about scope of access in this module before so I went ahead and kept this issue public.
Comment #5
mradcliffegit show fail.
Comment #7
mradcliffe