Problem / motivation
The core tracker module is a really useful module that enables tracking of recent content for users.
The main problem is that the most of times we want to enable and allow just admins or content editors to access this interface, but the module is currently using the default _permission: 'access content' for "/activity" url (see tracker.routing.yml). The most of times you might not want to have content types or users names disclosed to the anonymous users.
Steps to reproduce
1) Enable Activity Tracker module
2) As anonymous user, try to access http://yoursitedomain.com/activity
You might see all the information about the users activity, including "Page type", "Page Title", "Author", "Comments" and "Last Updated Date". There is no way to control who can see this information.
Proposed solution
Create a new "access users activity" permission and use it instead of the default "access content". It is possible to have better control of who should see the page by having this new permission type.
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
This extension is deprecated and scheduled for removal in Drupal 11.
This is now Postponed. The status is set according to two policies. The Remove a core extension and move it to a contributed project → and the Extensions approved for removal → policies.
It will be moved to the contributed extension → once the Drupal 11 branch is open.
