Views checks the session for exposed filters when it shouldn't

Created on 9 January 2025, 12 days ago

Problem/Motivation

Discovered in 📌 Search must be indexed after recipe is applied Active .

automated_cron runs at the end of request, after the session is closed.

Views can use session storage to set default values of exposed input.

Views can also be search indexed if they're rendered as part of rendering a node (or any search indexing that ends up rendering views).

However, ViewsExecutable happily checks session information when rendering - this could theoretically mean that an individual user's saved filter settings would influence what gets search indexed, which should not happen. Either way, it results in headers already sent with automated cron.

It also looks like ViewsExecutable does this for anonymous users even when the view isn't configured to do so.

e.g. FilterPluginBase checks roles, ViewExecutable doesn't.

At a minimum, ViewExecutable should not be checking the session when the view isn't configured for it.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

🐛 Bug report
Status

Active

Version

11.0 🔥

Component

views.module

Created by

🇬🇧United Kingdom catch

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024