#Needs security review tag

Comment 4 days ago →
🇭🇺Hungary mxr576 Hungary
@quietone Thanks for your review, back to you!

I have also updated Unpublished nodes are no longer hidden on Content overview page when a node access module is enabled → CR and created "Published status or admin user" Views filter becomes inactive when a node access module is enabled → CR to ensure granular and precise notification about the change.
in Drupal core » The Content overview page filters out unpublished nodes when a node access module is enabled
Comment 4 days ago →
🇭🇺Hungary mxr576 Hungary
Unrelated FunctionalJS failures, let's see if rebase from master helps...

It did.
in Drupal core » The Content overview page filters out unpublished nodes when a node access module is enabled
Comment 4 days ago →
🇭🇺Hungary mxr576 Hungary
Unrelated FunctionalJS failures, let's see if rebase from master helps...
https://git.drupalcode.org/issue/drupal-3449181/-/pipelines/277201/test_...
in Drupal core » The Content overview page filters out unpublished nodes when a node access module is enabled
Comment 6 days ago →
🇳🇿New Zealand quietone New Zealand
Yes, the Usability tag → remains. The use of the tag is part of the Usability gate → .

Thanks for the title update, it is much better now.

The comment above, #32 made me realize that the class docs for NodeViewsData should be updated to explain what the class will do with this change.

I left both suggestion and questions in the MR. I updated the links for that 'after' screen shots in the issue summary to the images from #35 . I did not review the change record.
in Drupal core » The Content overview page filters out unpublished nodes when a node access module is enabled

#Needs security review

Issues

The Content overview page filters out unpublished nodes when a node access module is enabled
Needs work
Drupal core 11.0 — node system
Created 4 months ago

[policy, no patch] Secondary subdomain for viewing oEmbed content is confusing and pointless
Active
Drupal core 11.0 — media system
Created over 3 years ago

Allow to change upload formats for managed_file
Needs work
Menu Link Attributes 1.0
Created over 1 year ago

ValidReferenceConstraintValidator should not try to enforce data integrity on pre-existing references
Needs work
Drupal core 11.0 — entity_reference.module
Created over 6 years ago

Security review for 8.x-1.0
Active
Resource Hints 1.0
Created over 7 years ago

Use TrustedRedirectResponse Error on Multilingual Setup
Needs work
Drupal core 11.0 — routing system
Created over 8 years ago

Consider using phpstorage for update module
Closed: outdated
Drupal core 11.0 — update.module
Created over 8 years ago

User must be logged-in to use the cancel account link that is emailed
Needs work
Drupal core 11.0 — user.module
Created almost 8 years ago

Allow the use of symlinks within the files directory.
Needs work
Drupal core 11.0 — file system
Created over 13 years ago

Should "iFrame domain" also set "X-Frame-Options" header
Needs work
Drupal core 11.0 — media system
Created about 5 years ago

Dots in query parameter names converted to underscores
Needs work
Drupal core 11.0 — menu system
Created about 6 years ago

Password reset form error makes no sense when the account is locked
Needs work
Drupal core 11.0 — user system
Created over 1 year ago

Url only outputs the last value of a query parameter
Needs work
Drupal core 11.0 — routing system
Created over 5 years ago

Security review of secure signing components for package manager
Needs work
Drupal core 11.0 — update.module
Created over 1 year ago

"Restrict images to this site" restricts images that, by definition, are on this site.
Needs work
Drupal core 11.0 — filter.module
Created about 6 years ago

Avoid overwriting .htaccess changes during scaffolding > security problem
Needs work
Drupal core 11.0 — composer
Created almost 5 years ago

Don't automatically set a cookie domain
Needs work
Drupal core 11.0 — base system
Created over 6 years ago

[PP-1] Add security checking for Symfony Mailer transports
Postponed
Drupal core 11.0 — mail system
Created about 1 year ago

Allow README.md to optionally render as the project page
Fixed
Drupal.org customizations 3.0
Created about 12 years ago

Stream wrappers don't decode url encoded URIs
Needs work
Drupal core 9.5 — file system
Created over 12 years ago

Apply for Drupal Security Advisory Coverage
Closed: duplicate
Advanced Link Attributes 2.5
Created about 1 year ago

Please opt into security advisory coverage
Closed: duplicate
Widen Collective 1.0
Created almost 7 years ago

text_summary() returns a plain string, even if passed a MarkupInterface object
Needs work
Drupal core 11.0 — text.module
Created about 5 years ago

Allow password reset on account with the username matching another email; prevent registrations that match another account
Needs work
Drupal core 11.0 — user.module
Created almost 13 years ago

Deprecate the "Full HTML" text format in Standard and Umami in favor of a "content editor HTML" for content editor roles
Active
Drupal core 11.0 — filter.module
Created almost 5 years ago

Create a global "kill switch" for Package Manager?
Active
Automatic Updates 3.0
Created over 2 years ago

Allow selection of which folder a file is to on the file/add form
Needs review
File Entity (fieldable files) 2.0
Created over 11 years ago

Add YAML support to serialization module
Needs work
Drupal core 10.1 — serialization.module
Created over 11 years ago

Do not use the .php extension in mtime protected storage to work around bogus PHP extensions
Postponed: needs info
Drupal core 10.1 — base system
Created about 4 years ago

make x-frame-options configurable
Postponed
Drupal core 10.1 — request processing system
Created over 8 years ago

The XSS filter should allow more HTML entities
Needs work
Drupal core 10.1 — base system
Created about 5 years ago

MapItem unserialize function in setValue method should allow TranslatableMarkup class
Needs work
Drupal core 10.1 — field system
Created over 5 years ago

Xss::filter() does not handle HTML tags inside attribute values
Closed: duplicate
Drupal core 10.1 — filter.module
Created about 3 years ago

Drupal 10 compatibility
Fixed
jQuery UI 1.0
Created over 2 years ago

\Drupal\Core\Security\PharExtensionInterceptor is incompatible with GeoIP and other libraries that use phar aliases or Phar::mapPhar()
Needs work
Drupal core 10.1 — bootstrap system
Created over 5 years ago

User email should not be case sensitive
Postponed
Drupal core 10.1 — user.module
Created over 9 years ago

htmlspecialchars() expects parameter 1 to be string, array given
Needs work
Drupal core 9.5 — markup
Created over 5 years ago

Activities

#Needs security review

Issues

The Content overview page filters out unpublished nodes when a node access module is enabledNeeds workDrupal core 11.0 — node system Created 4 months ago

[policy, no patch] Secondary subdomain for viewing oEmbed content is confusing and pointlessActiveDrupal core 11.0 — media system Created over 3 years ago

Allow to change upload formats for managed_fileNeeds workMenu Link Attributes 1.0 Created over 1 year ago

ValidReferenceConstraintValidator should not try to enforce data integrity on pre-existing referencesNeeds workDrupal core 11.0 — entity_reference.module Created over 6 years ago

Security review for 8.x-1.0ActiveResource Hints 1.0 Created over 7 years ago

Use TrustedRedirectResponse Error on Multilingual SetupNeeds workDrupal core 11.0 — routing system Created over 8 years ago

Consider using phpstorage for update moduleClosed: outdatedDrupal core 11.0 — update.module Created over 8 years ago

User must be logged-in to use the cancel account link that is emailedNeeds workDrupal core 11.0 — user.module Created almost 8 years ago

Allow the use of symlinks within the files directory.Needs workDrupal core 11.0 — file system Created over 13 years ago

Should "iFrame domain" also set "X-Frame-Options" header Needs workDrupal core 11.0 — media system Created about 5 years ago

Dots in query parameter names converted to underscoresNeeds workDrupal core 11.0 — menu system Created about 6 years ago

Password reset form error makes no sense when the account is lockedNeeds workDrupal core 11.0 — user system Created over 1 year ago

Url only outputs the last value of a query parameterNeeds workDrupal core 11.0 — routing system Created over 5 years ago

Security review of secure signing components for package managerNeeds workDrupal core 11.0 — update.module Created over 1 year ago

"Restrict images to this site" restricts images that, by definition, *are* on this site.Needs workDrupal core 11.0 — filter.module Created about 6 years ago

Avoid overwriting .htaccess changes during scaffolding > security problemNeeds workDrupal core 11.0 — composer Created almost 5 years ago

Don't automatically set a cookie domainNeeds workDrupal core 11.0 — base system Created over 6 years ago

[PP-1] Add security checking for Symfony Mailer transportsPostponedDrupal core 11.0 — mail system Created about 1 year ago

Allow README.md to optionally render as the project pageFixedDrupal.org customizations 3.0 Created about 12 years ago

Stream wrappers don't decode url encoded URIsNeeds workDrupal core 9.5 — file system Created over 12 years ago

Apply for Drupal Security Advisory Coverage Closed: duplicateAdvanced Link Attributes 2.5 Created about 1 year ago

Please opt into security advisory coverageClosed: duplicateWiden Collective 1.0 Created almost 7 years ago

text_summary() returns a plain string, even if passed a MarkupInterface objectNeeds workDrupal core 11.0 — text.module Created about 5 years ago

Allow password reset on account with the username matching another email; prevent registrations that match another accountNeeds workDrupal core 11.0 — user.module Created almost 13 years ago

Deprecate the "Full HTML" text format in Standard and Umami in favor of a "content editor HTML" for content editor rolesActiveDrupal core 11.0 — filter.module Created almost 5 years ago

Create a global "kill switch" for Package Manager?ActiveAutomatic Updates 3.0 Created over 2 years ago

Allow selection of which folder a file is to on the file/add formNeeds reviewFile Entity (fieldable files) 2.0 Created over 11 years ago

Add YAML support to serialization moduleNeeds workDrupal core 10.1 — serialization.module Created over 11 years ago

Do not use the .php extension in mtime protected storage to work around bogus PHP extensionsPostponed: needs infoDrupal core 10.1 — base system Created about 4 years ago

make x-frame-options configurablePostponedDrupal core 10.1 — request processing system Created over 8 years ago

The XSS filter should allow more HTML entitiesNeeds workDrupal core 10.1 — base system Created about 5 years ago

MapItem unserialize function in setValue method should allow TranslatableMarkup classNeeds workDrupal core 10.1 — field system Created over 5 years ago

Xss::filter() does not handle HTML tags inside attribute valuesClosed: duplicateDrupal core 10.1 — filter.module Created about 3 years ago

Drupal 10 compatibilityFixedjQuery UI 1.0 Created over 2 years ago

\Drupal\Core\Security\PharExtensionInterceptor is incompatible with GeoIP and other libraries that use phar aliases or Phar::mapPhar()Needs workDrupal core 10.1 — bootstrap system Created over 5 years ago

User email should not be case sensitivePostponedDrupal core 10.1 — user.module Created over 9 years ago

htmlspecialchars() expects parameter 1 to be string, array givenNeeds workDrupal core 9.5 — markup Created over 5 years ago

Activities

The Content overview page filters out unpublished nodes when a node access module is enabled
Needs work
Drupal core 11.0 — node system
Created 4 months ago

[policy, no patch] Secondary subdomain for viewing oEmbed content is confusing and pointless
Active
Drupal core 11.0 — media system
Created over 3 years ago

Allow to change upload formats for managed_file
Needs work
Menu Link Attributes 1.0
Created over 1 year ago

ValidReferenceConstraintValidator should not try to enforce data integrity on pre-existing references
Needs work
Drupal core 11.0 — entity_reference.module
Created over 6 years ago

Security review for 8.x-1.0
Active
Resource Hints 1.0
Created over 7 years ago

Use TrustedRedirectResponse Error on Multilingual Setup
Needs work
Drupal core 11.0 — routing system
Created over 8 years ago

Consider using phpstorage for update module
Closed: outdated
Drupal core 11.0 — update.module
Created over 8 years ago

User must be logged-in to use the cancel account link that is emailed
Needs work
Drupal core 11.0 — user.module
Created almost 8 years ago

Allow the use of symlinks within the files directory.
Needs work
Drupal core 11.0 — file system
Created over 13 years ago

Should "iFrame domain" also set "X-Frame-Options" header
Needs work
Drupal core 11.0 — media system
Created about 5 years ago

Dots in query parameter names converted to underscores
Needs work
Drupal core 11.0 — menu system
Created about 6 years ago

Password reset form error makes no sense when the account is locked
Needs work
Drupal core 11.0 — user system
Created over 1 year ago

Url only outputs the last value of a query parameter
Needs work
Drupal core 11.0 — routing system
Created over 5 years ago

Security review of secure signing components for package manager
Needs work
Drupal core 11.0 — update.module
Created over 1 year ago

"Restrict images to this site" restricts images that, by definition, are on this site.
Needs work
Drupal core 11.0 — filter.module
Created about 6 years ago

Avoid overwriting .htaccess changes during scaffolding > security problem
Needs work
Drupal core 11.0 — composer
Created almost 5 years ago

Don't automatically set a cookie domain
Needs work
Drupal core 11.0 — base system
Created over 6 years ago

[PP-1] Add security checking for Symfony Mailer transports
Postponed
Drupal core 11.0 — mail system
Created about 1 year ago

Allow README.md to optionally render as the project page
Fixed
Drupal.org customizations 3.0
Created about 12 years ago

Stream wrappers don't decode url encoded URIs
Needs work
Drupal core 9.5 — file system
Created over 12 years ago

Apply for Drupal Security Advisory Coverage
Closed: duplicate
Advanced Link Attributes 2.5
Created about 1 year ago

Please opt into security advisory coverage
Closed: duplicate
Widen Collective 1.0
Created almost 7 years ago

text_summary() returns a plain string, even if passed a MarkupInterface object
Needs work
Drupal core 11.0 — text.module
Created about 5 years ago

Allow password reset on account with the username matching another email; prevent registrations that match another account
Needs work
Drupal core 11.0 — user.module
Created almost 13 years ago

Deprecate the "Full HTML" text format in Standard and Umami in favor of a "content editor HTML" for content editor roles
Active
Drupal core 11.0 — filter.module
Created almost 5 years ago

Create a global "kill switch" for Package Manager?
Active
Automatic Updates 3.0
Created over 2 years ago

Allow selection of which folder a file is to on the file/add form
Needs review
File Entity (fieldable files) 2.0
Created over 11 years ago

Add YAML support to serialization module
Needs work
Drupal core 10.1 — serialization.module
Created over 11 years ago

Do not use the .php extension in mtime protected storage to work around bogus PHP extensions
Postponed: needs info
Drupal core 10.1 — base system
Created about 4 years ago

make x-frame-options configurable
Postponed
Drupal core 10.1 — request processing system
Created over 8 years ago

The XSS filter should allow more HTML entities
Needs work
Drupal core 10.1 — base system
Created about 5 years ago

MapItem unserialize function in setValue method should allow TranslatableMarkup class
Needs work
Drupal core 10.1 — field system
Created over 5 years ago

Xss::filter() does not handle HTML tags inside attribute values
Closed: duplicate
Drupal core 10.1 — filter.module
Created about 3 years ago

Drupal 10 compatibility
Fixed
jQuery UI 1.0
Created over 2 years ago

\Drupal\Core\Security\PharExtensionInterceptor is incompatible with GeoIP and other libraries that use phar aliases or Phar::mapPhar()
Needs work
Drupal core 10.1 — bootstrap system
Created over 5 years ago

User email should not be case sensitive
Postponed
Drupal core 10.1 — user.module
Created over 9 years ago

htmlspecialchars() expects parameter 1 to be string, array given
Needs work
Drupal core 9.5 — markup
Created over 5 years ago