After being applied to the 8.x branch, it should be considered for backport to the 7.x branch.
Note: This tag should generally remain even after the backport has been written, approved, and committed.

Early exit when maintenance mode is enabled and users have the permission to access the site in maintenance mode, or when the redirect URL has not been set

The last steps the code takes before redirecting users is checking whether maintenance mode is enabled, the logged in user has the permission to access the site in maintenance mode, and the redirect URL has been set.

The code should instead:

  • If the redirect URL has not been set, exit immediately
  • If maintenance mode is enabled and the logged in user has the access site in maintenance mode permission, exit immediately

Then, the code should verify the other conditions are met.

Validate the redirect URL only when "Enable URL redirect" is selected

To understand what this issue suggests should be changed, follow these steps:

Make "Redirect URL" required when "Enable URL redirect" is selected

When the Enable URL redirect checkbox is selected, the Redirect URL text field is made visible, but it should also be made required, or that field could be used to submit an empty value.

Handling pagination for user groups

Problem/Motivation

The user group API endpoint has a default limit of 100 groups by request. This means that if a user has >100 user groups, we only get the first 100 and none of the rest.

We need to handle pagination to fetch the rest.

Steps to reproduce

It's not practical to test with 100 user groups... these are steps to simulate the issue with fewer groups.

Menu administrators can manage links they can't access and thereby see the titles (including node titles)

Originally reported to the Drupal security team by @David_Rothstein on 26 October 2017.

The original report suggested this affected D7 and D8. Assuming it affects the latest version, this issue's version is set to D10.0.

---

Pages

Subscribe with RSS Subscribe to RSS - Needs backport to D7