Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Secret Links: Share Links Feature Not Working for Restricted Records on drafts #2706

Open
Samk13 opened this issue Jun 19, 2024 · 3 comments
Labels
bug Something isn't working

Comments

@Samk13
Copy link
Member

Samk13 commented Jun 19, 2024

Package version (if known): V12rc2

Describe the bug

The share links feature on a restricted record does not work for both unauthenticated and authenticated users.

Steps to Reproduce

  1. Create a restricted record in a restricted community and publish it / or save the draft.
  2. Go to share -> links -> create a new link -> copy the link.
  3. Open an incognito window and paste the link -> see permission required.
  4. Login as a new user and try to open the link -> still see permission required.

Expected behavior

The link should open the restricted record for users with the correct permissions.

@Samk13 Samk13 added the bug Something isn't working label Jun 19, 2024
@Samk13
Copy link
Member Author

Samk13 commented Jun 19, 2024

Related to #2694

@ntarocco
Copy link
Contributor

ping @anikachurilova, can you please try to reproduce this issue?

@anikachurilova
Copy link
Contributor

@Samk13 Thank you for reporting this!
Indeed, the problem exists if restricted record is being a part of a restricted community. The reason is that to have any kind of access to a restricted record of a restricted community, having a secret link is not enough, the user have to be also a member of this community with a role that allows them the corresponding access. So in this case, secret link permission allows seeing the record, but community restriction forbids it, as a result there is a 403 error.

Expected behavior: authorized, as well as guest users have access to the record with a secret link independently of the community. However, community name should not be displayed on the landing page of a record for users that are not members (TBD).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

3 participants