bachirandClaude Sonnet 5
27a799e937
Found while adding field_entree_liee's autocomplete: core's system.entity_autocomplete route is '_access: TRUE' by design -- EntityQuery::accessCheck() only enforces node grants (published status), not the base 'access content' permission, so it doesn't respect this site's login-only lockdown the way every other route does. Verified anonymously via plain curl that the *existing* field_client (client taxonomy) autocomplete leaked real client names the same way -- this isn't specific to the new field, it's a gap in any entity reference autocomplete on the site. hook_route_alter() doesn't exist anymore in this Drupal version (routing moved to an event-based RoutingEvents::ALTER subscriber) -- a first attempt using the procedural hook silently did nothing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>