?
avatar sozzled
sozzled
19 May 2020

Steps to reproduce the issue

  1. Use a standard J! 3.9.18 website, Protostar, and create a menu item (for the main menu) of the type Login and give the menu item "Public" access.
  2. Go to the frontend; see that the Login menu item appears, click the menu item, enter the user credentials and click the form submit/login button. (Most likely this will work, unless the website has other extensions enabled, e.g. the System - Privacy Consent plugin).
  3. Notice that the Login menu item displays on the menu. This is expected
  4. Logout. Go to the backend and change the access for the menu item, from"Public" to "Guest".
  5. Refresh the frontend. Step 2 but observe that the message "You are not authorised to view this resource" now appears on the page.
  6. Notice that the Login menu item does not appear on the menu (because you are now logged-on as a Registered user); this is expected.

The problem also occurs if you login as a site administrator or superuser.

Expected result

Login without message "You are not authorised to view this resource"

Actual result

Login with message on page "You are not authorised to view this resource". The message is removed if the viewer refreshes the page.

System information (as much as possible)

See detailed system information on the J! forum at https://forum.joomla.org/viewtopic.php?f=728&t=980139 including screenshots.

Additional comments

Apparently this issue has been around for some time as reported on the J! forum at https://forum.joomla.org/viewtopic.php?f=624&t=787950, https://forum.joomla.org/viewtopic.php?t=904134 and on Stackoverflow at https://stackoverflow.com/questions/34883387/joomla-3-4-8-logged-in-users-seeing-error-you-are-not-authorised-to-view-this-re.

The issue has been reproduced by me on two different servers, running different versions of PHP 7.x, with SEF URLs, and using either SSL and non-SSL.

avatar sozzled sozzled - open - 19 May 2020
avatar joomla-cms-bot joomla-cms-bot - labeled - 19 May 2020
avatar sozzled sozzled - change - 19 May 2020
The description was changed
avatar sozzled sozzled - edited - 19 May 2020
avatar brianteeman
brianteeman - comment - 19 May 2020

This would be the expected behaviour. Let me try to explain.
We have a permission tree like this
public
--guest
--registered
----author

Notice that guest and registered are at the same level. They are both branches from public.

A registered user does not have access to the content in guest because it is not in their tree.

These two branches exist for this very purpose - being able to hide content from registered users and being able to hide content from public users.

The login page is in the guest branch and registered users do not have access to that branch. So as soon as they log in and their status changes to registered they will be denied access to the page.

The solution (it is a solution and not a hack as this is the intended behaviour) is to make sure that you set a login redirect to a page that the registered user will have access to. In this example that would be anything in public or registered.

image

avatar sozzled
sozzled - comment - 19 May 2020

I agree with your summary of the ACL structure, Brian, and that's normal on a vanilla-flavoured, out-of-the-box, unmodified J! 3 website. The test websites I've used are configured this way. No changes were made to those things.

The screenshot that you've included is exactly what I'm using. Again, this is the default behaviour when creating the Login menu item. Nothing spectacular about that, either.

The target of the menu item (being directed to whatever is the "default") is also typical. In the test case I've given, the target is a single article that has view access = Public. The target may default to the "user profile edit" screen if the System - Privacy Consent plugin has been enabled, and the user has not yet consented to the site privacy policy, but that's not at issue here.

Have you tried this yourself (followed the step-by-step as I have described)?

Remember, this behaviour occurs with every vanilla-flavoured, out-of-the-box, J! website that I've created. No fancy-pants mucking around with anything. It's just basic J!. It's not a major defect but it's a little disconcerting to new users who want to use the Login menu item for people to login to their websites and, as a consequence of logging in, their end-users are greeted with a rosy-pink box that says they're not authorised to view some "resource". And, sure, the message disappears if the end user refreshes the page. But, why do that?

This problem doesn't exist with the Login module. Why does it exist with the Login menu item?

We're not talking about denying access to a page (upon login); the page is displayed but with a big "you are not authorised" message. Sure, the Login menu item is hidden (as it's supposed to be hidden) because a logged-in users is no longer a Guest. But, surely, not displaying a menu item (which is what people want) should not be a case of someone somehow being "not authorised", should it?

avatar brianteeman
brianteeman - comment - 19 May 2020

Have you tried this yourself (followed the step-by-step as I have described)?

Of course

Here is the recording of the front end working

front

Here are the screenshots of the menu setting

image

image

avatar sozzled
sozzled - comment - 19 May 2020

Thanks, Brian.

I'll create another out-of-the-box, vanilla-flavoured, no-frills, no-fancy pants, J! 3.9.18 website, with Protostar, (this time without a home page article), and try it again.

BTW, what do you use to create that nifty animation. If I strike out again, I'd like to use something like that in future, too. Cheers.

=====> (off to do might battle with Wampserver ... again ... sigh ...)

avatar sozzled
sozzled - comment - 19 May 2020

One noticeable difference I see in the menu item settings. In the first screenshot you posted, the Menu Item Login Redirect is "Default"; in the second screenshot, the target is "Home". Does it matter? I've always used the "default" which is "Default".

avatar brianteeman
brianteeman - comment - 19 May 2020

Did you not read the tooltip on the login redirect ;) ? Default is the current page

image

The animation is created with licecap - open source, free of cost and cross platform

avatar sozzled
sozzled - comment - 19 May 2020

Well, I want to stay on the "same page" (and that's what happens, except for the "You are unauthorised" business). Like I said, I configured a website, with a nothing-to-speak-of Home page (being a Public-access single article) and created a Login menu item (with Guest view access) and what happens is, yes, you are logged-in, yes, you stay on the same page but, b****r-me-dead, "you are not authorised" ... unnghh

But maybe we have a different understanding of what is the "same page"?

I mean, what is the "same page", here? The page with the login form, perhaps (because that's the last thing a person used)? I guess the "default" is a bit murky there and the site owner has to change the target if they want to use the Login menu item. The problem, if this is the cause, is that everyone has been showing me screenshots of what are the default settings (and those are what I've been using) and the default settings may be the cause of the problem ... ?

Thanks for letting me know about licecap; I've got to get me one of those heh--heh-heh. I'll be back to this in a while. Thanks.

avatar brianteeman
brianteeman - comment - 19 May 2020

The log in menu item is a page just like any other page. So if you dont have the correct access you will get that message

avatar sozzled
sozzled - comment - 19 May 2020

Ah-hah! Problem solved. The "same page" is the login menu item page (which has Guest access) and therefore can't be viewed if you are logged-in (i.e. you are now Registered). This has been baffling because all the help I've see says (if you want to display the login form for Guests but "hide" it if you're Registered) do say that you need to redirect the view somewhere else, after logging in, but the help(s) just show the "default" settings (as Brian showed in his first reply).

You need to change the target in the Login menu item (both for login and logout) to another view that the Registered user can use. If you don't do this, you still login but you're sent to whatever page is more "appropriate" along with the "You are not authorised to view this resource" (i.e. the login form itself) message.

A bit of a fiddle but not a problem. I'm closing this issue. Thanks very much for your help, Brian. Best wishes.

avatar sozzled sozzled - close - 19 May 2020
avatar sozzled sozzled - change - 19 May 2020
Status New Closed
Closed_Date 0000-00-00 00:00:00 2020-05-19 23:13:15
Closed_By sozzled
avatar brianteeman
brianteeman - comment - 19 May 2020

As i said - its the intended behaviour

avatar sozzled
sozzled - comment - 19 May 2020

Agreed; it's literally intentional. For the average punter, who might be in that situation (as I've written elsewhere, this isn't something I would normally break sweat over because I rely mostly on using the Login module. But in the case of a few people who prefer to use menu items to do these things, a bit of extra know-how is needed.

avatar BartelBe
BartelBe - comment - 19 Apr 2021

All true, but for usability sake, you can avoid all the fuzz (for the webmaster without the thorough experienced based troubleshooting) by simply requiring to select a page, instead of defaulting to an error situation in case of guest access.

Add a Comment

Login with GitHub to post a comment