It's easy to forget the user cache context when doing stuff based on the current user.
Add the cache context and tag automatically whenever any user-specific data is accessed on the current_user service.
None.
None.
None.
None.
Postponed
11.0 🔥
cache system
The change is currently missing an automated test that fails when run with the original code, and succeeds when the bug has been fixed.
It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
If I understand #86 correctly, this was postponed until 8.1. So it can probably be reevaluated now.
Adding triage credits as per #86.
I discussed this with @catch, @xjm, and @alexpott, and regrettably, we agree with Wim's earlier conclusion in #56 and again in #80 that this isn't viable for core in 8.0.
It's definitely eligible to be considered now on that basis, although we'd want to evaluate whether the approach is still valid.