Yikes! - URL Segment Bypasses Template Access Control

[Jim Bailie]

I have a page: "example.com/privatepage" that has a template requiring users with a specific role.

But if I type in "example.com/privatepage/some-url-segment" then the page renders!!

I'm not seeing an obvious solution in the template settings...

[da²]

Hello,

I can't reproduce here on PW 3.0.228, what version are you using and are you sure you don't test this page with a superuser (who has access to everything)?

[Jan Romero]

Hi, I tried to reproduce this without success (3.0.208 dev). Can you share more about your setup?

[Jim Bailie]

Thanks. Ok, this is a closed application and there's a 404 redirect in config.php set to go to a page/template with active access control.

Therefore if I add a url segment to a protected page/template, it will get 404 redirected to a page/template that should redirect to a login page if there is no active session, but that protected page is rendered instead.

I hope this makes sense. It's not the end of the world as I will need to do some checking in the code, but it is unexpected behavior.

[JoseFrasher]

On 11/7/2023 at 11:54 PM, Jim Bailie said:

Thanks. Ok, this is a closed application and there's a 404 redirect in config.php set to go to a page/template with active access control.

Therefore if I add a url segment to a protected page/template, it will get 404 redirected to a page/template that should redirect to a login page if there is no active session, but that protected page is rendered instead.

I hope this makes sense. It's not the end of the world as I will need to do some checking in the code, but it is unexpected behavior.

Any update?

[ColtNikolaus]

Seems no.

[Jim Bailie]

@JoseFrasher Update: Not really. It is what it is. If you set your 404 page to a page with a protected template, that page will render for Guest and not redirect to the page that it should redirect to **If you have a url segment in the URL**.

My solution was to just create a dedicated 404 page with its own template and handle things there. Probably a better approach than what I had originally.