Identify invalid preview links

[hiasl]

What happened?

Description

I would like to be able to detect expired preview links. Currently I get the correct preview content as long as the token is valid, afterwards I get the published content instead.

Why? Because our editors send out preview links to colleagues and the colleagues never know if the content they preview is the published or the modified content.

Steps to reproduce

1. I modify the content of an entry without saving
2. I click on "View", a new tab opens with the entry's URL and the 2 params x-craft-preview and token
3. The content shows all the changes -> OK
4. I delete the used token from the database
5. I reload the preview URL, now it shows the published content instead, but no hint that the token is outdated.

Expected behavior

I would either like to show the user a warning or redirect him somewhere else, if the preview token is not valid anymore

Actual behavior

I do not see a way to notice if it's preview or not

Craft CMS version

3.8.17

PHP version

7.4.33

Operating system and version

Linux 5.10.104-linuxkit

Database type and version

PostgreSQL 12.14

Image driver and version

Imagick 3.7.0 (ImageMagick 6.9.11-60)

Installed plugins and versions

Agnostic Fetch
Asset Interceptor
Blitz
Cloner
Conditional Fields
Control Panel CSS
Cookies
Glossary
Imager X
KeyChain
Minify
Neo
Preparse Field
Publisher
Redactor
Redactor Anchors
Relax
SAML Service Provider
Sprig
SuperSort
Super Table
Typed link field

[brandonkelly]

(Converted this to a discussion because it’s currently working as intended.)

One possibility is you could start adding a banner across the top of the page when a preview token is used.

{% if craft.app.request.getIsPreview() %}
  <div class="preview-banner">
    You’re currently previewing unpublished content.
  </div>
{% endif %}

[hiasl]

Thanks Brandon. I was not aware of the getIsPreview() property and I guess this will do it.

[hiasl]

Hi Brandon,
I just tried this, but it does not help. The problem is that the property / method getIsPreview() you refer to only checks the URL and its params, but not if the token is valid and therefor it always returns true as soon as the GET params are there. See below:

    public function getIsPreview(): bool
    {
        return $this->getQueryParam('x-craft-preview') !== null || $this->getQueryParam('x-craft-live-preview') !== null;
    }

Any other ideas?

Thanks,
Matthias

[brandonkelly]

Ah, thanks for pointing that out. Just fixed that for the next release (a48f008).

[brandonkelly]

Craft 4.5.14 is out with that fix. So now craft.app.request.getIsPreview() will return false if the token has expired.

[hiasl]

Any chance for a backport to Craft 3? and thanks!

[brandonkelly]

Done (1f31166). Just tagged 3.9.10 today, so can’t say when the next v3 release will go out, but you can get this now by changing your craftcms/cms requirement in composer.json to v3.x-dev#1f3116622a003b3bd272f299b76dcfa2204aa7e4 as 3.9.10, and running composer update.

[brandonkelly]

3.9.11 is out now with that change.