Problem/Motivation
The CR Access checking must be explicitly specified on content entity queries
contains the following sentence:
Until Drupal 9.2, if ::accessCheck() is not called then the query would default to checking access, i.e. behave as if ::accessCheck(TRUE) had been called.
This is misleading, because it implies that the default value changed in Drupal 9.2, which is not the case. Even in Drupal 9.2 (and later 9) the query defaults to checking access when accessCheck() is not called.
Proposed resolution
Change the wording of the CR to make it more clear that the default value didn't change. Suggested new wording for the paragraph starting with above mentioned sentence and the following paragraph:
If ::accessCheck() is not called then the query defaults to checking access, i.e. behave as if ::accessCheck(TRUE) has been called. This behavior has been the source of many bugs, as it is easy for developers to forget that this happens.
In Drupal 9.2, not calling ::accessCheck() has been deprecated, and all entity queries on content entities should always include an explicit call to ::accessCheck() prior to the query being executed. For Drupal 10 this will be enforced by throwing an exception if ::accessCheck() is not called.
Comments
Comment #3
smustgrave commentedYou can commit on the CR. May get better traction. I see others have already.