?
avatar clinchergt
clinchergt
26 Oct 2014

Steps to reproduce the issue

  1. create an article for registered users only,
  2. create a menu item to aforementioned article,
  3. go to the front-end of the site and log in,
  4. access the article through the menu item,
  5. log out,
  6. click menu item.

Expected result

Get error explaining I'm not authorized to access the article since I'm not logged in.

Actual result

Get redirected to the site's homepage.

System Information

Database: 5.5.40-0ubuntu0.14.04.1
PHP: 5.5.9-1ubuntu4.4
Joomla version: Joomla! 3.3.6 Stable
Joomla platform version: Joomla Platform 13.1.0 Stable
User Agent: Mozilla/5.0 Firefox/33.0

Additional Information

Make sure to use an incognito/private browsing window to ensure that neither cookies nor the cache will affect the testing.

If you try accessing the article without ever having logged in, you'll get what was described in the "Expected result" section, so it's the logging in that's causing this behaviour after logging out.

avatar clinchergt clinchergt - open - 26 Oct 2014
avatar jissues-bot jissues-bot - change - 26 Oct 2014
Labels Added: ?
avatar brianteeman brianteeman - change - 28 Oct 2014
Category Authentication Multilanguage
avatar infograf768
infograf768 - comment - 1 Nov 2014

I confirm this behaviour.

This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/4934.

avatar clinchergt clinchergt - change - 1 Nov 2014
The description was changed
avatar clinchergt
clinchergt - comment - 1 Nov 2014

Turns out this isn't multilingual dependant. Same bug happens on a regular site.

This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/4934.

avatar clinchergt
clinchergt - comment - 1 Nov 2014

@infograf768 Could you confirm it happens on non-multilingual sites? I just edited the issue and added a comment (I had edited it on github, but it seems this issue tracker overrides the one on github, so I had to make the edit again).

@brianteeman Maybe we should remove the multilanguage tag? Sorry about that.

This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/4934.

avatar Bakual
Bakual - comment - 1 Nov 2014

Works fine when I test it with Chrome. I get an error

Error
You are not authorised to view this resource.

On IE11 I get redirected to the homepage. Even after loggin in again I can't access the article.
Same behavior on Firefox.
That's really strange imho.

avatar Bakual
Bakual - comment - 1 Nov 2014

(I had edited it on github, but it seems this issue tracker overrides the one on github, so I had to make the edit again).

If you make an edit on GitHub, it doesn't update JIssues. But as soon as someone makes a new comment, your edit will be updated on JIssues as well. I think it has to do with the way the GitHub API works.

avatar brianteeman brianteeman - change - 1 Nov 2014
Category Authentication Multilanguage Authentication
avatar mbabker
mbabker - comment - 1 Nov 2014

Ya, the API doesn't send out data on edited items anymore.

avatar infograf768
infograf768 - comment - 2 Nov 2014

Firefox Macintosh: Redirects to FrontPage

Message**

**You have been redirected to the home page following logout**
avatar infograf768
infograf768 - comment - 2 Nov 2014

Looks like we consider that error here as a 403, so instead of redirecting to the real message handleError(&$error) in the logout system plugin redirects to home page
debug shows:

object(JException)[541]
  protected 'level' => int 2
  protected 'code' => int 403
  protected 'message' => string '**You are not authorised to view this resource.**' (length=49)
  protected 'info' => string '' (length=0)
  protected 'file' => string '/Applications/MAMP/htdocs/trunkgitnew/libraries/legacy/error/error.php' (length=70)
  protected 'line' => int 177
  protected 'function' => null
  protected 'class' => null
  protected 'type' => null
  protected 'args' => 

The only solution I found is to change the code inROOT/components/com_content/views/article/view.html.php
to

// Check the view access to the article (the model has already computed the values).
        if ($item->params->get('access-view') == false && ($item->params->get('show_noauth', '0') == '0'))
        {
            $app->enqueueMessage(JText::_('JERROR_ALERTNOAUTHOR'), 'warning');

            return;
        }

As far as I know the handleError(&$error) method in that plugin is the only place in core using a conditional checking for a 403

// Make sure the error is a 403 and we are in the frontend.
        if ($error->getCode() == 403 and $app->isSite())
        {
avatar infograf768
infograf768 - comment - 3 Nov 2014

I looked at the original code (in 2010)
the 403 specific error and redirect was intended when logging out while editing an article.

avatar brianteeman brianteeman - change - 3 Jan 2015
Status New Confirmed
avatar zero-24
zero-24 - comment - 8 May 2015

Closing as we have a PR by @clinchergt here: #5019 Thanks

avatar zero-24 zero-24 - change - 8 May 2015
Status Confirmed Closed
Closed_Date 0000-00-00 00:00:00 2015-05-08 22:15:10
Closed_By zero-24
avatar zero-24 zero-24 - close - 8 May 2015

Add a Comment

Login with GitHub to post a comment