Currently when I request for menu items and some of them are disabled, they still are included in the list. There is no way of telling from the response that which of the links are enabled/disabled, not to mention that should they even be in the list.

I do not consider this as an security issue, because enable/disable state is not in relation to permissions.

Steps to reproduce:

  • Create a menu
  • Create three links, say 1 2 and 3
  • Request for menu items, expect three links
  • Now go and disable link number 2
  • Request for menu items, expect two links => FAILS, I still see all three

Comments

iMiksu created an issue. See original summary.

andrechun’s picture

andrechun commented

Disabled menu item no longer shown after running "drush cr".

imiksu’s picture

imiksu
Location Finland
commented

Then I guess it's an cache purging problem?

fabianderijk’s picture

fabianderijk
him/his
Primary language Dutch
Location Alphen aan den Rijn
commented
Status: Active » Closed (works as designed)

If all works when clearing the cache, then I don't think it's an issue with this module. Marking it as closed (works as designed)