Article for registred visible to all #11285

tonicopi · 2016-07-24T12:59:44Z

Steps to reproduce the issue

1 - Create a menu item pointing to an article for registered users

2 - In the general options of Content set YES on Show Unauthorised Links

3 - Click in the menu item of point 1 without being logged into the site

Expected result

I was expecting a message asking me to register.

Actual result

Instead I read the article, also google can read it then shows it to the world!

System information (as much as possible)

Additional comments

mbabker · 2016-07-24T13:55:34Z

Did you set the menu item to registered or the article, or both? If it was only the menu item, that'd only change when that part is displayed, so if the article is set to public you need to change that as well.

tonicopi · 2016-07-24T14:16:08Z

The menu item is public.
I find wrong, seriously wrong, which is visible in this way publicly the content reserved of Article!

ggppdk · 2016-07-24T14:42:27Z

@tonicopi
There is a detail you have not mentioned,

does the article contains a read-more ?

If it does then this is normal behavior, it is a feature that can be useful to your web-site, just add the text that you need to be visible to ALL users, before the read-more

In article view

The (intro) text before the read-more will show as a "Tease" when you enable "Unauthorized links"
and then if you click on the read more you should get an no access message or a redirect to login register

is the above the case ?

tonicopi · 2016-07-24T14:58:16Z

NO the article has no Read More

Regards

Tonicopi

Il 24/07/2016 16:42, Georgios Papadakis ha scritto:

@tonicopi https://github.com/tonicopi
There is a detail you have no mention,

does the article contains a read-more ?

If it does then this is normal behavior, it is a feature that can be
useful to your web-site, just add the text that you need to be
visible to ALL users, before the read-more

In article view

The (intro) text before the read-more will show as a "Tease" when
you enable "Unauthorized links"

and then if you click on the read more you should get an no access
message or a redirect to login register

is the above the case ?

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#11285 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/ATq13wH0L6HL9UXMfAvmJyUl8n2ln-ybks5qY3nfgaJpZM4JTkiK.

ggppdk · 2016-07-24T15:11:15Z

If you add read-more to it, then does it works as described above ?

tonicopi · 2016-07-24T15:32:15Z

Yes

Please try the following steps:

Create a new "Blog category" menu item and set it as Public
Publish an article without a read more and set it as Registered
The article will be completely public, without any restriction, if in Articles Global Settings (or if in the options of the blog menu item) the option "Show unauthorized links" is set to yes.

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11285.}

jeckodevelopment · 2016-07-24T15:34:09Z

I can confirm. It's an ACL violation.

Steps to reproduce the issue

Create a new category and set as Public
Create a menu item, Category Blog, pointing to such category.
Set (in the menu item options) "Show unauthorized links" on Yes.
Create an article (without readmore) and set it as Registered.

Expected result
The article set as Registered shouldn't be visible.

Actual result
You'll be able to see the whole content of the article even if it's for Registered users.

jeckodevelopment · 2016-07-24T15:41:58Z

If you add a read more in the article, you can see properly the Intro text and it asks for Login/registration to see the complete content.

If you set "Show unauthorized links" to No, the article is not visible.

ghost · 2016-07-24T16:06:34Z

I can confirm. It's an ACL violation.

I don't think so. If you set "Show unauthorized links" to yes you agree that title and introtext (a field in the database) are shown to everybody. Images, field fulltext and links to the article are not shown.

Otherwise the setting "Show unauthorized links" would be senseless. Changing this behavior would be a B\C break.

If there's no readmore marker inside the article the whole text is saved in database field introtext.

Maybe the description could be more clear?

JGLOBAL_SHOW_UNAUTH_LINKS_DESC="If set to Yes, links to registered content will be shown even if you are not logged-in. You will need to log in to access the full item."

ggppdk · 2016-07-24T16:06:44Z

If you add a read more in the article, you can see properly the Intro text and it asks for Login/registration to see the complete content.

So is it a requirement that the article has a read more , when "Show unauthorized links" is set to "Yes" ?

Originally this setting was meant for category view to show intro-text (and intro image) of non-privileged content and link to article view with a redirection to login ? , but then

for SEO purposes
for making article view to do "teasing"

article view was also modified to show intro image and intro-text , right ??

First, the DB model does well to allow this, (=behaves according to configuration)

So it is not an ACCESS violation, it seems to me that

either the view (view.html.php) should check this
or the default template of article view is bogus and shows more that what is supposed to show

jeckodevelopment · 2016-07-24T16:12:25Z

@bertmert , I agree on Intro Text and other informations.
But i don't agree on the Full text.

AlexRed · 2016-07-24T19:10:24Z

I confirm the issue

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11285.}

ghost · 2016-07-24T20:04:23Z

Joomla works like this at least since Joomla 1.5. Changing it would be a B\C break.

See an example with Joomla 1.5

Article "We are Volunteers":

Registered.
Menu Articles » Category / Blog: => Show Unauthorised Links: YES.

Without readmore:

With readmore:

@jeckodevelopment

But i don't agree on the Full text.

There is no fulltext in database if there's no readmore.
There are 2 fields in the DB: introtext and fulltext. If there's no readmore fulltext is empty and the whole text is interpreted as introtext.
If you want to hide the complete text you have to insert a readmore at the beginning of the editor text.

One possibility could be to add a further configuration option "Hide introtext, too" or something. = new feature.

Another one is to handle it via template overrides.

if ($params->get('access-view')) :
 Show text
else :
 Hide text
endif;

ggppdk · 2016-07-24T20:40:17Z

@bertmert

you show category view, yes, it is like this for a long time

about article view it also seems to be like this a long time, (i checked github history of the template file)
i wrongly believed this feature was added much later

Was there ever a check in article view ?:

if no read-more (thus no full-text too) and no-view-access on article,
then redirect to login regardless of "show unauthorized" ?

ghost · 2016-07-24T21:47:16Z

Ah, sorry! The opener of this issue talked about article, later on about category blog.

Was there ever a check in article view ?: if no read-more (thus no full-text too), then redirect to login immediately ?

As far as I remember, no. In Joomla 1.5 the single article view was blocked completely. Just a login. Only the blog showed the introtext. Reason is that in 1.5 only menu item had an option "Show Unauthorised Links".

2.5 had only a similiar check like in current staging:
https://github.com/joomla/joomla-cms/blob/staging/components/com_content/views/article/view.html.php#L133-L140

Another find: If "Show Unauthorised Links" is YES and "Show Intro Text" is HIDE (in article and a menu pointing to this article) I see this (intro text):

If "Show Unauthorised Links" is NO I don't see a login form like in Joomla 1.5

jeckodevelopment · 2016-07-24T22:27:49Z

@bertmert I know that without readmore there's no FullText, but, I think you can agree that in this case the ACL on the Article will be ignored and this is not right.

mbabker · 2016-07-24T22:45:34Z

Well, yes and no. The specific configuration allows for it to be bypassed
and IIRC it's a configuration you have to explicitly enable. So that
config may need to be better documented, but from the sounds of things I'm
not entirely convinced we have a bug.

On Sunday, July 24, 2016, Luca Marzo notifications@github.com wrote:

@bertmert https://github.com/bertmert I know that without readmore
there's no FullText, but, I think you can agree that in this case the ACL
on the Article will be ignored and this is not right.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
#11285 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AAWfoVJz4by3oi6_GWt1avYDd7rDAyK7ks5qY-bmgaJpZM4JTkiK
.

jeckodevelopment · 2016-07-24T22:48:43Z

This specific configuration ignore the ACL of the article. If it's not a real issue, it's a "particular behaviour" and we need to document it.

mbabker · 2016-07-24T22:54:33Z

Right, it's a very explicit circumstance based on configuring another feature. Unless you've got a better way to handle the feature, this particular set of circumstances is a side effect of having it.

jeckodevelopment · 2016-07-24T23:01:44Z

otherwise we need a check, if the FullText field is empty and the article is set as Registered (or whatever that is not Public) we can show only the title and prompt the login (same behaviour in case of readmore).

ggppdk · 2016-07-25T00:28:50Z

if the FullText field is empty and the article is set as Registered

ok, if this is added, then yes we check if fulltext is empty

but then we do not check for registered access , we check for no-access (access-view FLAG is set) and user is guest

Natural place to add this

should after the IF statement of view HTML, that serves similar purpose, but is incomplete here:

https://github.com/joomla/joomla-cms/blob/staging/components/com_content/views/article/view.html.php#L133-L140

i have made a PR #11290

brianteeman · 2016-07-25T08:41:45Z

I am closing this as we have a PR for testing see #11290

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11285.}

jeckodevelopment · 2016-07-25T09:33:18Z

Thank you @ggppdk :)

joomla-cms-bot added the No Code Attached Yet label Jul 24, 2016

ggppdk mentioned this issue Jul 25, 2016

Prevent misuse of show_noauth param when fulltext is empty #11290

Merged

brianteeman closed this as completed Jul 25, 2016

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Article for registred visible to all #11285

Article for registred visible to all #11285

tonicopi commented Jul 24, 2016 •

edited by brianteeman

mbabker commented Jul 24, 2016

tonicopi commented Jul 24, 2016

ggppdk commented Jul 24, 2016 •

edited

tonicopi commented Jul 24, 2016

ggppdk commented Jul 24, 2016

tonicopi commented Jul 24, 2016

jeckodevelopment commented Jul 24, 2016

jeckodevelopment commented Jul 24, 2016

ghost commented Jul 24, 2016

ggppdk commented Jul 24, 2016 •

edited

jeckodevelopment commented Jul 24, 2016

AlexRed commented Jul 24, 2016

ghost commented Jul 24, 2016

ggppdk commented Jul 24, 2016 •

edited

ghost commented Jul 24, 2016 •

edited by ghost

jeckodevelopment commented Jul 24, 2016

mbabker commented Jul 24, 2016

jeckodevelopment commented Jul 24, 2016

mbabker commented Jul 24, 2016

jeckodevelopment commented Jul 24, 2016

ggppdk commented Jul 25, 2016

brianteeman commented Jul 25, 2016

jeckodevelopment commented Jul 25, 2016

Article for registred visible to all #11285

Article for registred visible to all #11285

Comments

tonicopi commented Jul 24, 2016 • edited by brianteeman

Steps to reproduce the issue

Expected result

Actual result

System information (as much as possible)

Additional comments

mbabker commented Jul 24, 2016

tonicopi commented Jul 24, 2016

ggppdk commented Jul 24, 2016 • edited

tonicopi commented Jul 24, 2016

ggppdk commented Jul 24, 2016

tonicopi commented Jul 24, 2016

jeckodevelopment commented Jul 24, 2016

jeckodevelopment commented Jul 24, 2016

ghost commented Jul 24, 2016

ggppdk commented Jul 24, 2016 • edited

jeckodevelopment commented Jul 24, 2016

AlexRed commented Jul 24, 2016

ghost commented Jul 24, 2016

Article "We are Volunteers":

Without readmore:

With readmore:

ggppdk commented Jul 24, 2016 • edited

ghost commented Jul 24, 2016 • edited by ghost

jeckodevelopment commented Jul 24, 2016

mbabker commented Jul 24, 2016

jeckodevelopment commented Jul 24, 2016

mbabker commented Jul 24, 2016

jeckodevelopment commented Jul 24, 2016

ggppdk commented Jul 25, 2016

brianteeman commented Jul 25, 2016

jeckodevelopment commented Jul 25, 2016

tonicopi commented Jul 24, 2016 •

edited by brianteeman

ggppdk commented Jul 24, 2016 •

edited

ggppdk commented Jul 24, 2016 •

edited

ggppdk commented Jul 24, 2016 •

edited

ghost commented Jul 24, 2016 •

edited by ghost