Repository navigation
Scope the report and theme counts to the sites a user can see - #727
Merged
Merged
Conversation
The publishing and accessibility readiness reports, the demo install health counts, the dashboard overview counts and the theme site counts read every site's data, so a user restricted to one site saw page names, site names, edit links and counts for all of them. They now go through the site scope with deny-when-no-actor; global users still see everything. The theme delete guard still checks usage across all sites, and the legacy foundation theme is hidden only when no site at all uses it.
howdu
enabled auto-merge (squash)
October 2, 2026 16:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A user restricted to one site could read data about every site through the admin reports and theme screens: the publishing and accessibility readiness reports listed all page names, site names, language names and edit links; the demo install health report and the dashboard overview counted every site and page; and theme site counts included sites the user cannot access.
Change
pages/sitescounts go throughSiteScope::applyForCurrentActor(..., denyWhenMissingActor: true). Asking for an unassigned site returns nothing.foundationtheme is hidden only when no site at all uses it.Tests
New
ReportSiteScopeTestandThemeSiteCountScopeTestplus one demo-health case: scoped user sees one site, global user sees all, no actor sees nothing, and a delete of a theme used only on hidden sites is still blocked. The scoped cases failed on the unmodified code and pass now. Locally:packages/admin/tests2226 passed; Pint, Rector, PHPStan clean on changed files.Not covered
BuildPublicRenderSafetyReportActionfindings, theThemeValidationblock message (reports the total site count) andThemeExtensionPagein the marketplace package (unscoped site list and apply-to-all) are unchanged and need their own change.