Any user with site access can access protected page media

[jackbrycesmith]

Hi there,

Came across some undesirable behaviour in a certain scenario with the following config:

protect_protected_page_media: true
parent_acl: true

Scenario

• user1 & user2 both have site access
• /restricted has defined that only user1 can access the page
• user1 can access /restricted
• if user2 tries to access /restricted, they will see the contents of unauthorized.md (as expected)
• if user2 tries to access media files, e.g. /restricted/media.jpg, they can see them (undesirable)

Note: if a guest user tries to access /resticted/media.jpg, they will be redirected to a login page as expected.

So any user with site access will be able to access media files of a protected page, regardless of that protected page excluding certain users based on a group e.g. whether they have paid.

Did a quick fix locally by doing a 302 redirect if the uri extension is a media type, near the end of setUnauthorizedPage()

grav-plugin-login/login.php

Lines 415 to 434 in 3f9560a

	public function setUnauthorizedPage()
	{
	$route = $this->config->get('plugins.login.route_unauthorized');
	/** @var Pages $pages */
	$pages = $this->grav['pages'];
	$page = $pages->dispatch($route);
	if (!$page) {
	$page = new Page;
	$page->init(new \SplFileInfo(__DIR__ . '/pages/unauthorized.md'));
	$page->template('default');
	$page->slug(basename($route));
	$pages->addPage($page, $route);
	}
	unset($this->grav['page']);
	$this->grav['page'] = $page;
	}

Wanted to see whether there was a better way of doing this?

[rhukster]

can you create a pull request so i can easily test this? Cheers.

[rhukster]

This actually turned out to be a bigger problem. You can't redirect non-HTML requests to HTML pages, so moved this up into authorizePage() and simply throw an 403 error if unauthorized.

4e6199e

Also this uncovered an issue with page's that were not found under protected pages. That's fixed in Grav develop branch.

getgrav/grav@a4ab5d9

Please test if possible :)

[jackbrycesmith]

Cheers - tested the latest release & works as expected 👍