Problem/Motivation

In the context of #540008: Add a container parameter that can remove the special behavior of UID#1 it was found that several contrib modules hardcode a check for user ID 1 (traditionally, in Drupal this user receives all possible permissions due to a hardcoded check in the access check routine). This is a bad practice either way, but will become more problematic when core actually removes this behaviour, because site maintainers may become less careful about uid=1.

Proposed resolution

Add a sniff to the DrupalPractice profile that seeks out code checking against the user ID being equal to 1, pointing to the risks and the above issue (may later be changed to point to a change record outlining the change).

Remaining tasks

  1. Agree this makes sense as a change for Coder
  2. Write a patch
  3. Commit

Comments

eelkeblok created an issue.

solideogloria’s picture

solideogloria commented

I agree that this change makes sense for Coder.

It would be hard to detect many cases, however, as people have used id() < 2 to detect either anonymous or admin, id() < 1, etc.