URL aliases can be used to override trusted urls

If it would be sufficient to mark the permission as "trusted" (as @catch suggested), then uploading a patch with this change.

Adding a tag and a list of contributors in the original issue

Adding this for a final review. If the fix is sufficient, I think that we can proceed here. I personally agree the restricted bit is sufficient given this comment:

We should open a public issue to make 'administer URL aliases' have the 'restrict access' bit. It seems completely reasonable to add that based on the public information in https://www.drupal.org/project/drupal/issues/121362 🐛 Do not allow existing or reserved paths as aliases Needs work which is 16 years old now.

mcdruid → credited berdir → .

mcdruid → credited catch → .

mcdruid → credited dsnopek → .

mcdruid → credited effulgentsia → .

mcdruid → credited mlhess → .

mcdruid → credited moshe weitzman → .

mcdruid → credited poiu → .

mcdruid → credited samuel.mortenson → .

Adding credit.

Thanks everyone!

n.b. leaving the "Needs change record" tag in place.

Created a draft CR for this: https://www.drupal.org/node/3491616 →

As discussed in slack, we probably need to check if this should be done in D10/11 as well. But we decided to commit this despite the backport policy, since this is the last D7 release.

Automatically closed - issue fixed for 2 weeks with no activity.