Can't hide pages/templates from guests

[Fester]

I'm trying to hide some of the pages on my website from users that are not logged in. I'm trying to achieve this by changing the settings of the page's template like so:

This hides the page from my navigation which is good, but it doesn't block the user from surfing to the page directly which I think should be happening if I interpret the settings correctly?

When I first encountered this issue I was running PW 2.6 but I've since updated to 2.6.8 alas to no avail.

I hope someone will be able to help me out and I will be happy to provide more information about this issue if need be.

I'm currently working around this issue by adding a $user->isLoggedin() include to my pages but this isn't as clean as setting the permissions directly from the CMS imo.

[Troost]

Hi Fester,

If I understand your question, you can unpublish the page by going to the page you want to hide -> settings -> check unpublished. (The admin and editor can see it trough pressing the view button in the tabs)
 

If this ain't what youre looking for I am sorry, my PHP skills don't reach so far.

Cheers

[Fester]

That's not exactly what I'm looking for, I want to make the page visible to any user that's logged in. Some users on my website don't have access to the CMS.

[teppo]

This hides the page from my navigation which is good, but it doesn't block the user from surfing to the page directly which I think should be happening if I interpret the settings correctly?

Your interpretation is correct, and the settings you've posted here should indeed deny access to the page for guests (non-logged-in users).

Testing on the 2.6 branch, I can't seem to easily reproduce similar issue. There's a couple of things I'd like to check first, though:

1. Do you have any additional permission-related modules installed – Dynamic Roles, UserGroups, PageEditPerUser, anything like that?
2. Any other modules you can think of that could cause this behaviour? Do you have any third party modules installed at all?
3. Are you absolutely sure that the page that is publicly viewable is using this template? Just trying to be extra thorough here
4. Do you have any kind of caching going on, a proxy running in front of the site, content cached in CloudFlare, etc.?

All in all this kind of issue would be much easier to debug if there was some way to see it in action, and/or if you could provide easy steps for reproducing it on a clean install of ProcessWire. It would be very helpful if you could test this with a clean installation, and see if it happens there too; if not, it could be something weird with this particular site, but at least that would give us some pointers about what to check next.

[ryan]

@Fester your settings look correct to me. A page using that template would only be visible to superuser, editor and registered user roles. So something must be overriding access control in your case, like Teppo suggested. Double check that you are testing with a guest user. By that, I mean logout and test, open in different browser (that's not logged in), or open the page in an Incognito/Private window. I think Teppo mentioned all the possible things, and I don't have more to add to it, but please let us know what you find. 

[Fester]

Thanks for your time guys I apologize if my initial post was a bit brief. In response to Teppo's questions:

Do you have any additional permission-related modules installed – Dynamic Roles, UserGroups, PageEditPerUser, anything like that?

I have two modules that might be interfering with the access of the page, the first one being FrontendUser and the second one is Persistent Login for users. 

Any other modules you can think of that could cause this behaviour? Do you have any third party modules installed at all?

I'm running six modules in total, I previously mentioned two and the other four are FormHelper, Email New user,  Force Password Change and Upgrades.

Are you absolutely sure that the page that is publicly viewable is using this template? Just trying to be extra thorough here 

I understand your thoroughness but I'm encountering this issue on multiple pages that are using different templates

 

Do you have any kind of caching going on, a proxy running in front of the site, content cached in CloudFlare, etc.?

As far as I know there's no server side caching going on, I've tested this on multiple devices and private browsing windows too so I don't think it's a client caching thing either.

And @Ryan

So something must be overriding access control in your case 

 Could you give an example of what could be overriding the access control? I can't think of anything besides modules and custom PHP code to change the users access (of which there is none in my site).

Again thank you so much for taking your time to help me out with this issue! I'm going to see if I'm able to reproduce the issue on a clean install of processwire and report back with my findings.

[Fester]

Ok I've found the issue!

Cause of my issue: I batch assigned the registered_user role to a bunch of users on my website. But in doing so I also assigned the registered_user role to the default guest user.

This of course caused anyone who was not logged in to have the registered_user role and made them able to view pages they weren't supposed to.

Sorry for overlooking this issue before posting here and thanks again for your help everyone!

[teppo]

Glad to hear that you got it sorted!