install Joomla 4.0.0b1 with no sample content
go to Template options and enable Preview Module Positions
Go to site modules and ensure - confirm - that there is no mod_footer configured or enabled (by default there is not)
Visit your frontend using ?tp=1
Module position names show
Module position names show
mod_footer is rendered in the bottom right with the Joomla copyright information
Requesting @joomla/security (hmm team deleted?)
@SniperSister review, because this could be considered a security issue. Note also that other module positions are populated on the page using tp=1 when they should not be, example the top menu position renders a MENU when none is configured in that place either.
Labels |
Added:
?
|
Title |
|
Title |
|
Because they don’t exist!
There are no modules named “mod_footer” in the position “footer” configured on the site when you go to “Site Modules” therefore it should not show up ever - even when tp=1
Just because its always been this way doesn't mean its right
Note also that other module positions are populated on the page using tp=1 when they should not be
They should be. That's the whole point of module position preview.
They should be. That's the whole point of module position preview.
I don't think that module CONTENT of a not existing module should be rendered. In this case mod_footer is rendered even if it's not existing under Modules. Other positions without applied modules only display the black labels but not the CONTENT of something.
OK, I misunderstood the issue. If no modules are assigned to a position, we try to load a module based on position name (mod_footer
for footer
position). The code is here:
joomla-cms/libraries/src/Helper/ModuleHelper.php
Lines 99 to 107 in 6aa0e48
I misunderstood the issue. If no modules are assigned to a position, we try to load a module based on position name
Thus leaking information on a site with tp=1 enabled.
Can anyone explain what this kind of scatter gun approach to loading a module by its name that just happens to clash with the position name
, is needed in Joomla 4?
This is not new in 4.0.
I never said it was new in 4.0 - I’m simply challenging the status quo and asking why it still needs to be here, when you could take this major series change to remove such crap and ancient bugs ...
No one has yet been able to tell me why it needs to be this scatter gun approach and why we need at least one module loaded in the tp =1 mode (hint, we don’t need this - it can be scrapped if joomla has the guts)
Currently if I have a mod_custom and a custom module position then the html from that module can be loaded if tp=1 is enabled (and 32% of sites in mySites.guru have this enabled on their first snapshot with our service!!!)
If you can justify why you need to load a module then I’m all ears?? Else joomla is just dragging stuff into joomla 4 for the sake of it
Sent from my iPhone
On 8 Jun 2020, at 22:19, SharkyKZ notifications@github.com wrote:
This is not new in 4.0.—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or unsubscribe.
We do need this to make sure all positions are shown regardless of whether a module is published in any given position. But the code can probably improved.
Fine, if there is a reason then there is a reason.
But you manage to show all the other positions when they have no modules published in them ok without falsely publishing a random name matched module ... so I’m still not convinced.
Sent from my iPhone
On 8 Jun 2020, at 23:18, SharkyKZ notifications@github.com wrote:
We do need this to make sure all positions are shown regardless of whether a module is published in any given position. But the code can probably improved.—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or unsubscribe.
See the screenshot in the opening comment - the search position has nothing in it but it’s still shown ok
10+ other module positions are shown correctly without pushing a false module published into them
I’m still not seeing why you need to push a module content to the screen just to show a position when the others don’t
Sent from my iPhone
On 8 Jun 2020, at 23:18, SharkyKZ notifications@github.com wrote:
We do need this to make sure all positions are shown regardless of whether a module is published in any given position. But the code can probably improved.—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or unsubscribe.
Status | New | ⇒ | Closed |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2020-06-09 07:14:04 |
Closed_By | ⇒ | SharkyKZ |
Why should those modules not be populated? This is exactly the same behaviour as with Joomla 1, 2, 3