[Bug]: 403 Error in Guest mode

[savage7]

部署方式 | How to Deploy

Docker (Default)

部署版本 | Version

5.3.0

Git 哈希值 (长度 40)| Git Ref (40 length)

98670cd

反代服务 | Reverse Proxy

nginx

HTTPS 证书类型 | HTTPS(SSL)

可受信任的证书 Verified SSL

已阅读文档 | Read the document

• 已阅读 | Yes

描述 | Description

I have disabled guest mode.
I have an App with a scheme.

Actual Behavior:
When I scan the QR Code from a scheme like https://myurl/V25w1/181 I get a 403 when I'm not logged in.
However when I open https://myurl/V25w1 directly I can see all builds and click install, to install the latest build.
The QR Codes encodes a build url like https://myurl/V25w1/181, as a guest i always get a 403 for all builds.

Expected Behavior:
It's possible to open the link of a build as guest user, since its also possible to open the scheme and install builds.
It's possible to install all build, not just the latest one.

问题日志 | Relevant log output

No response

[icyleaf]

Turning off guest mode means that visitors cannot view the app's version details page unless they have set a password for the app channel, and access is possible through key authentication.

[savage7]

@icyleaf aaaahh ok, I was not aware of this, thank you.

The thing is when you log in as guest that the user sees the scheme https://myurl/V25w1 and can install the latest version.
But when the user scans the barcode it has a url that he cannot open https://myurl/V25w1/181.
I would expect that in guest mode the user would get https://myurl/V25w1 as barcode url and doesn't see links he is not allowed to see 🤷

[savage7]

@icyleaf
There seams to be some other issue regarding this.

• I set a password for the cannel (https://myurl/V25w1)
• When I open the url I have to enter the password
• After I enter it I get a 403 error
• When I reload the page I'm authenticated an see the download links

[icyleaf]

You are right, I can replicate this logic; there is a bug in it. Typically, https://myurl/V25w1 should not be accessible to visitors.

[icyleaf]

Pull nightly tag after this is finished.

[savage7]

@icyleaf thank you, just tested it and it's fixed. 💯

[icyleaf]

@savage7 After receiving feedback from users, I have modified the permission rules, now allowing guests to view details, and QR codes can be accessed as well.

[savage7]

@icyleaf Thanks for the update.