@wilsonge move the blocker tag here (if you agree with the changes)

I have tested this item successfully on 77b3d64

Tested that directly accessing a module directly is now disallowed. Also tested that frontend module editing continues to work without being affected by this PR

Expected result
Upon login, the admin console should open on the modules page.

At this stage, although I do not get an error after applying this PR, we never reach the Expected result, as posted multiple times.
The session times out, you have to login twice and are redirected to the Control Panel.

Same as @inforgraf768 reported

On 11 March 2016 at 09:59, infograf768 notifications@github.com wrote:

Expected result
Upon login, the admin console should open on the modules page.

At this stage, although I do not get an error after applying this PR, we
never reach the Expected result, as posted multiple times.
The session times out, you have to login twice and are redirected to the
Control Panel.

—
Reply to this email directly or view it on GitHub
#9371 (comment).

Brian Teeman
Co-founder Joomla! and OpenSourceMatters Inc.
http://brian.teeman.net/

@dgt41 I tried to test this with a sessio timeout of 5 minutes. Have the language switcher module open in edit options, added a pre-text, then left the browser tab alone for 15 minutes but I still can continue to edit there.

What did I get wrong in testing instructions? Do I have to close the browser tab to provoke the sesion timeout? What do I do wrong?

@richard67
I just saved to trigger the session time out (used 1 minute)

@infograf768 Ah, I shall save (but not close) ... ok, I'll try to reproduce the issue on unpatched Joomla! Tanks for the help.

Ah if you have a bit time and mood, you could test my latest PR Test is not as complicated as lenght of testing instructions might look like.

@richard67
if you talk about #9369 I would first have to do a cure of I.Q. to start understanding... ;)

@infograf768 You mean testing instructions too complicated? Or code? I do not wanna mess up this PR here with discussions for mine, so if you are interested and have questions of suggestions just post on my PR and we can discuss there. But I can understand if you not want to test it, because it is a bit work to test all, and it's not easy to see the benefit on a first view. But when having e.g. schema update sql scripts with correct comments like "--" you can see that in the joomla_update.php log file the queries are reported with comments prepended, and this caused in some cases problems. With my patch the pure sql statements are logged and executed. That's one benefit. Further discussions there in my PR if you want.

Still can't reproduce the problem that causes this PR ...

Also shouldn't modules edit have a keepalive??

Hmm, I still cannot reproduce the issue here. I am logged out when I try to save after expired session timeout, so I log in again, then get on login page at the top of the login form message that session has expired and I have to login again, and then after 2nd login I see control panel and all is fine, no errors.

Maybe the reason is because I use database and not PHP as session handler?

Maybe the reason is because I use database and not PHP as session handler?

i use database too.

Hmm still cannot reproduce, also not with session handler PHP. Maybe I have to use a particular type of module? I tried with language switcher.

@infograf768 yeah the double session login regression in is this #9016

@dgt41

Also shouldn't modules edit have a keepalive??

Tried again and again and still can't reproduce the problem without the patch.

Can anyone do a step by step instructions on how do we get this error???

There was another way mentioned by @C-Lodder

Simply copy and paste the following:
http://example.com/administrator/index.php?option=com_modules&layout=edit&id=27
Obviously changing example.com and 27 to a module ID that exists for you

There is another issue with the keep alive js: timing out & 500 error (localhost)!

Oops wrong button, can someone re-open this?

@dgt41

Simply copy and paste the following:
http://example.com/administrator/index.php?option=com_modules&layout=edit&id=27
Obviously changing example.com and 27 to a module ID that exists for you

Tested and still no issue....
Used: /administrator/index.php?option=com_modules&view=module&layout=edit&id=91 in my case

Oh i think i found the problem! Look at yours and mine URL! I have view=modules you don't ...

Why? Because i clicked in module title to edit, you probably selected the checked box and pressed the "Edit" button!

Why does joomla has different urls for editing modules!??!

@andrepereiradasilva make sure that before entering that url you are at admin control panel NOT in the modules component

@dgt41 i already said what the problem is, check my previous comment.

But you can test also:
1. Log out from admin panel
2. Try to access /administrator/index.php?option=com_modules&view=module&layout=edit&id=YOUR_MODULE_ID, the login panel will appear, login, and no error
3. Try to access /administrator/index.php?option=com_modules&layout=edit&id=YOUR_MODULE_ID, the login panel will appear, login, and ERROR

"2." is the URL behavior when, in modules component, you click on the module title to edit.
"3." is the URL behavior when, in modules component, you check a module checkbox and then press edit.

And that's why i and @richard67 was not having the issue and you and others have it.

I have not applied any patch for this tests. Pure 3.5.0 RC

Yes, error "You are not permitted to use that link to directly access that page (#99).", if no "&view=module", can confirm Andre's findings.

You need to be logged in, and at the cpanel (/administrator/index.php). Then insert the url...

You need to be logged in, and at the cpanel (/administrator/index.php). Then insert the url...

No you don't, test as i said in 3.5.0 RC without patch please:

1. Log out from admin panel
2. Try to access /administrator/index.php?option=com_modules&view=module&layout=edit&id=YOUR_MODULE_ID, the login panel will appear, login, and no error
3. Try to access /administrator/index.php?option=com_modules&layout=edit&id=YOUR_MODULE_ID, the login panel will appear, login, and ERROR

Please, try the url from the cpanel

@dgt41 we are both right.

You need to be logged in, and at the cpanel (/administrator/index.php). Then insert the url...

Is the same thing. The error exist because the view parameter doesn't exist in your URI.

So, IMHO the question is: in com_modules, if the view parameter is not sended via http GET or POST methods, by default should have the modules value (modules list view).
Of course this means the inconsistency of edit URI without view=module needed to be resolved.

You can check com_content article edit behavior with similar test to understand what i mean.

1. Go to CPanel (or logout)
2. Try to access /administrator/index.php?option=com_content&view=article&layout=edit&id=YOUR_ARTICLE_ID, you will be in edit panel
3. Try to access /administrator/index.php?option=com_content&layout=edit&id=YOUR_ARTICLE_ID, you will be the in article list panel

@andrepereiradasilva that's right and the approach is the same for com_modules

ok will test when have time.

I have tested this item successfully on 77b3d64

Test OK

It shows the error message "Error You are not permitted to use that link to directly access that page (#17)."

I have tested this item successfully on 77b3d64

Updated the title to something meaningful ;)

Two good tests - so merged :)

Still getting this error in Joomla! 3.5.0 Stable

Notice: Undefined property: ModulesViewModules::$filterForm in ...\administrator\components\com_modules\layouts\joomla\searchtools\default\bar.php on line 17

Fatal error: Call to a member function getField() on null in ...\administrator\components\com_modules\layouts\joomla\searchtools\default\bar.php on line 17

@stell - I also got the error again a while back but I think it was on RC-3 or 4. Seems to be fine on stable though. What steps did you take to get the error?

@C-Lodder It's a clean 3.5 Stable install. I just tried to save a module which had nothing in it but a paragraph. Other modules can be saved strangely. Cleaned cookies and cache already.

I have this issue too, how fix?

This bug still appears every now and then in 3.5.1. Can't reproduce it however.

Поставь Advanced Module Manager.
Мне помогло сразу.
Сам долго мучелся с этим.

Install Advanced Module Manage.
and it work

@phoenixdenis - Installing 3rd party extensions to fix something in core shouldn't be required

But this is the only way that works. Others did not help.

Using a third party extension means you aren't using the core extension. Which again doesn't fix the core issue, it just bypasses it.

Update max_input_vars in php.ini

This resolve my problem, tks AleksElDia!

I put max_input_vars = 2000 in my php.ini

\0/