?
avatar PhilETaylor
PhilETaylor
8 Jun 2020

Steps to reproduce the issue

install Joomla 4.0.0b1 with no sample content
go to Template options and enable Preview Module Positions
Go to site modules and ensure - confirm - that there is no mod_footer configured or enabled (by default there is not)

Visit your frontend using ?tp=1

Expected result

Module position names show

Actual result

Module position names show
mod_footer is rendered in the bottom right with the Joomla copyright information

Screenshot 2020-06-08 at 16 38 04

System information (as much as possible)

Additional comments

Requesting @joomla/security (hmm team deleted?)

@SniperSister review, because this could be considered a security issue. Note also that other module positions are populated on the page using tp=1 when they should not be, example the top menu position renders a MENU when none is configured in that place either.

Screenshot 2020-06-08 at 16 40 22

avatar PhilETaylor PhilETaylor - open - 8 Jun 2020
avatar joomla-cms-bot joomla-cms-bot - change - 8 Jun 2020
Labels Added: ?
avatar joomla-cms-bot joomla-cms-bot - labeled - 8 Jun 2020
avatar PhilETaylor PhilETaylor - change - 8 Jun 2020
Title
[4.0b1] mod_footer displays when it should not
[4.0b1] mod_footer displays when it should not with ?tp=1
avatar PhilETaylor PhilETaylor - edited - 8 Jun 2020
avatar PhilETaylor PhilETaylor - change - 8 Jun 2020
Title
[4.0b1] mod_footer displays when it should not with ?tp=1
[4.0b1] mod_footer renders content when it should not with ?tp=1
avatar PhilETaylor PhilETaylor - edited - 8 Jun 2020
avatar PhilETaylor PhilETaylor - change - 8 Jun 2020
The description was changed
avatar PhilETaylor PhilETaylor - edited - 8 Jun 2020
avatar brianteeman
brianteeman - comment - 8 Jun 2020

Why should those modules not be populated? This is exactly the same behaviour as with Joomla 1, 2, 3

avatar PhilETaylor
PhilETaylor - comment - 8 Jun 2020

Because they don’t exist!

There are no modules named “mod_footer” in the position “footer” configured on the site when you go to “Site Modules” therefore it should not show up ever - even when tp=1

Just because its always been this way doesn't mean its right

avatar SharkyKZ
SharkyKZ - comment - 8 Jun 2020

This is related to #25239.

avatar SharkyKZ
SharkyKZ - comment - 8 Jun 2020

Note also that other module positions are populated on the page using tp=1 when they should not be

They should be. That's the whole point of module position preview.

avatar ReLater
ReLater - comment - 8 Jun 2020

They should be. That's the whole point of module position preview.

I don't think that module CONTENT of a not existing module should be rendered. In this case mod_footer is rendered even if it's not existing under Modules. Other positions without applied modules only display the black labels but not the CONTENT of something.

avatar SharkyKZ
SharkyKZ - comment - 8 Jun 2020

OK, I misunderstood the issue. If no modules are assigned to a position, we try to load a module based on position name (mod_footer for footer position). The code is here:

if (count($result) === 0)
{
if ($input->getBool('tp') && ComponentHelper::getParams('com_templates')->get('template_positions_display'))
{
$result[0] = static::getModule('mod_' . $position);
$result[0]->title = $position;
$result[0]->position = $position;
}
}

avatar PhilETaylor
PhilETaylor - comment - 8 Jun 2020

I misunderstood the issue. If no modules are assigned to a position, we try to load a module based on position name

Thus leaking information on a site with tp=1 enabled.

Can anyone explain what this kind of scatter gun approach to loading a module by its name that just happens to clash with the position name, is needed in Joomla 4?

avatar SharkyKZ
SharkyKZ - comment - 8 Jun 2020

This is not new in 4.0.

avatar PhilETaylor
PhilETaylor - comment - 8 Jun 2020

I never said it was new in 4.0 - I’m simply challenging the status quo and asking why it still needs to be here, when you could take this major series change to remove such crap and ancient bugs ...

No one has yet been able to tell me why it needs to be this scatter gun approach and why we need at least one module loaded in the tp =1 mode (hint, we don’t need this - it can be scrapped if joomla has the guts)

Currently if I have a mod_custom and a custom module position then the html from that module can be loaded if tp=1 is enabled (and 32% of sites in mySites.guru have this enabled on their first snapshot with our service!!!)

If you can justify why you need to load a module then I’m all ears?? Else joomla is just dragging stuff into joomla 4 for the sake of it

Sent from my iPhone

On 8 Jun 2020, at 22:19, SharkyKZ notifications@github.com wrote:


This is not new in 4.0.


You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or unsubscribe.

avatar SharkyKZ
SharkyKZ - comment - 8 Jun 2020

We do need this to make sure all positions are shown regardless of whether a module is published in any given position. But the code can probably improved.

avatar PhilETaylor
PhilETaylor - comment - 8 Jun 2020

Fine, if there is a reason then there is a reason.

But you manage to show all the other positions when they have no modules published in them ok without falsely publishing a random name matched module ... so I’m still not convinced.

Sent from my iPhone

On 8 Jun 2020, at 23:18, SharkyKZ notifications@github.com wrote:


We do need this to make sure all positions are shown regardless of whether a module is published in any given position. But the code can probably improved.


You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or unsubscribe.

avatar PhilETaylor
PhilETaylor - comment - 8 Jun 2020

See the screenshot in the opening comment - the search position has nothing in it but it’s still shown ok

10+ other module positions are shown correctly without pushing a false module published into them

I’m still not seeing why you need to push a module content to the screen just to show a position when the others don’t

Sent from my iPhone

On 8 Jun 2020, at 23:18, SharkyKZ notifications@github.com wrote:


We do need this to make sure all positions are shown regardless of whether a module is published in any given position. But the code can probably improved.


You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or unsubscribe.

avatar SharkyKZ
SharkyKZ - comment - 9 Jun 2020

Please test PR #29521.

avatar SharkyKZ SharkyKZ - change - 9 Jun 2020
Status New Closed
Closed_Date 0000-00-00 00:00:00 2020-06-09 07:14:04
Closed_By SharkyKZ
avatar SharkyKZ SharkyKZ - close - 9 Jun 2020

Add a Comment

Login with GitHub to post a comment