Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Expose links the user can access #4718

merged 4 commits into from Nov 24, 2020


Copy link

Closes #2599

Uses the simplistic approach where links are visible if the user has permissions on them. It causes an access check on our side for every button, but realistically I'm assuming no impact while doing that.

We also considered creating an Indico redirector (could even contain a signature to avoid malicious access) but concluded it could become a burden for a simple use-case.

View with permissions (the redirection is immediate):

View without permission (the redirection goes through the server):

@plourenco plourenco marked this pull request as ready for review November 24, 2020 12:33
@ThiefMaster ThiefMaster changed the base branch from master to 2.3-maintenance November 24, 2020 13:11
@ThiefMaster ThiefMaster merged commit 1108650 into indico:2.3-maintenance Nov 24, 2020
ThiefMaster pushed a commit that referenced this pull request Nov 24, 2020
Link materials now use direct links so users can see the target URL.
In case someone has no access to a link we still go through the download
endpoint in order to trigger a proper access-denied page (or the redirect
to login).
@ThiefMaster ThiefMaster deleted the link-material branch November 24, 2020 13:16
@ThiefMaster ThiefMaster added this to the v2.3 milestone Nov 24, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
None yet
None yet

Successfully merging this pull request may close these issues.

Link material - make URL visible to the user
2 participants