Jump to content

Yikes! - URL Segment Bypasses Template Access Control


Jim Bailie
 Share

Recommended Posts

I have a page: "example.com/privatepage" that has a template requiring users with a specific role.

But if I type in "example.com/privatepage/some-url-segment" then the page renders!!

I'm not seeing an obvious solution in the template settings...

Link to comment
Share on other sites

Thanks. Ok, this is a closed application and there's a 404 redirect in config.php set to go to a page/template with active access control.

Therefore if I add a url segment to a protected page/template, it will get 404 redirected to a page/template that should redirect to a login page if there is no active session, but that protected page is rendered instead.

I hope this makes sense. It's not the end of the world as I will need to do some checking in the code, but it is unexpected behavior.

Link to comment
Share on other sites

  • 2 weeks later...

@JoseFrasher Update: Not really. It is what it is. If you set your 404 page to a page with a protected template, that page will render for Guest and not redirect to the page that it should redirect to **If you have a url segment in the URL**.

My solution was to just create a dedicated 404 page with its own template and handle things there. Probably a better approach than what I had originally.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...