Steps to reproduce
- configure restrictUserOperationLogToAuthenticatedUsers to false in process engine configuration
- have a REST-API endpoint without authentication
- for a process instance with historical variables, delete one historical entry via unauthenticated REST call
- click on the 'User Operations' tab in the process instance history - it loads forever
- The User Operations Tab loads
- operations with userID null are shown with empty 'User' column
- if the entry with null user is the only entry for the process instance
- the follow-up request on "/user" is with "idIn="
- the Chrome web console shows no error
- if the entry with null user is one of the entries for the process instance
- the follow-up request on "/user" is with "idIn=,demo"
- the Chrome web console shows: