Field visibility access is not applied correctly due to caching

Created on 16 May 2024, about 1 month ago
Updated 6 June 2024, 20 days ago

Problem/Motivation

Field visibility access is not applied correctly due to caching.

Steps to reproduce

  • Create role X.
  • Give role X the permissions to "view user information" and "Set own profile fields visibility".
  • Create user A and user B.
  • Assign role X to both users (Users should have same role(s)).
  • Add a field (e.g. Name) to user entity type.
  • Login as user A, allow other users to view your Name, enter your Name and then immediately visit your own profile page. You should see your Name (Perfect!).
  • Login as user B, visit user A profile, you should see the Name of user A (Perfect!).
  • Now login again as user A, do NOT allow other users to view your Name, then save and visit your own profile page. You should see your Name (Perfect!).
  • Now login again as user B, visit user A profile, you see user A name (NOT GOOD!).
  • Clear cache, and then as user B, visit user A profile, then you don't see user A Name (Perfect!)
  • Now login as user A, and visit your own profile, then you don't see your own Name (NOT GOOD!)

See also the attached failing (quickly implemented) test to demonstrate the issue.

Proposed resolution

Could be solved by applying the patch in 🐛 Cache metadata by plugins is discarded Needs review and do the necessary changes to user_fields_visibility field permission type plugin.

🐛 Bug report
Status

Active

Version

1.0

Component

Code

Created by

🇧🇪Belgium msnassar

Live updates comments and jobs are added and updated live.
  • Security

    It is used for security vulnerabilities which do not need a security advisory. For example, security issues in projects which do not have security advisory coverage, or forward-porting a change already disclosed in a security advisory. See Drupal’s security advisory policy for details. Be careful publicly disclosing security vulnerabilities! Use the “Report a security vulnerability” link in the project page’s sidebar. See how to report a security issue for details.

Sign in to follow issues

Comments & Activities

Production build 0.69.0 2024