Skip to content

Conversation

@distantnative
Copy link
Member

@distantnative distantnative commented Aug 7, 2025

Description

How to test

Changelog

🐛 Bug fixes

For review team

  • Add lab and/or sandbox examples (wherever helpful)
  • Add changes & docs to release notes draft in Notion

@distantnative distantnative added this to the 5.1.0 milestone Aug 7, 2025
@distantnative distantnative self-assigned this Aug 7, 2025
@distantnative distantnative linked an issue Aug 7, 2025 that may be closed by this pull request
@distantnative distantnative force-pushed the fix/6682-panel-login-redirect-404 branch from 774d8b2 to ba6a249 Compare August 7, 2025 13:05
@distantnative distantnative force-pushed the fix/6682-panel-login-redirect-404 branch from ba6a249 to 1226898 Compare August 7, 2025 13:08
@distantnative distantnative marked this pull request as ready for review August 7, 2025 13:15
@distantnative distantnative requested a review from a team August 7, 2025 13:15
Copy link
Member

@bastianallgeier bastianallgeier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this is calling the route already, couldn't this cause some side effects if the route would actually execute something? It could also have quite some performance hit for more complex routes. Checking for false is probably also not enough when routes could return error response objects instead. I'm not sure if we could solve it differently, but I'm a bit worried about the implications.

@distantnative
Copy link
Member Author

@bastianallgeier I get the concerns, let's try to dissect it a little:

  • This is only checking view routes. Yes, technically they could also execute code on load but I would say the scenario where code is executed which is harmful when executed by this check vs. any other visit is low. Though not impossible.
  • it surely has a performance implication. But only when this check is actually run. Which is only after login. So not on the regular Panel navigation. We could consider whether we want to differentiate between remembered paths which should be checked and maybe blueprint-defined paths (where we might skip the check and if it results in errors, the developer can easily adjust the blueprint). Ideally we would check both, but if this is a concern.
  • We should indeed consider some other return values and whether we then consider the route as valid redirect target or not.

@distantnative
Copy link
Member Author

We could also skip calling the route for common routes we know will work by this point (e.g. site).

Copy link
Member

@lukasbestle lukasbestle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with Basti that it's risky to call route code in a method called hasAccess. Even if our views don't have side effects, we cannot guarantee it in the future and also for plugin views, so this is a risk that could become a security vulnerability later.

Trying to understand why the old code didn't already cover this: There must be a fallback route for non-existing views that returns false, right? Couldn't we add a flag to it that can be easily detected without calling the route action?

@bastianallgeier
Copy link
Member

I like @lukasbestle' idea. Maybe we could make sure to always throw a NotFoundException in our error routes and catch that?

@distantnative
Copy link
Member Author

The case here is that we want to specifically handle the remembered redirect after the login.

The suggestion would mean we just always redirect to site if a Panel route is not found without an error message. Not just after login.

@bastianallgeier
Copy link
Member

Forget my comment. We would still need to run the route action for what I suggested. I mix things up in my head here.

@lukasbestle
Copy link
Member

lukasbestle commented Aug 18, 2025

Trying to approach this from a different perspective:

Do we even want to silently redirect to the site view on a "page not found" error?

If I'm already logged in and try to visit a page view of a non-existing page, I get a proper view with the error message. From there I can navigate to whatever other view I want, so I'm not lost.

Could we do the same with the redirect after login? So instead of displaying the error in a dialog on the login view, we would perform the redirect to the provided URL and display the k-error-view there as normal.

@bastianallgeier
Copy link
Member

@lukasbestle good point. The error dialog is definitely weird here. I had that in different scenarios where it really bothered me. So this is something that we should definitely fix - independently from the login redirect issue. If a redirect leads to an error view, the redirect should go through and not lead to the error dialog.

@distantnative
Copy link
Member Author

I think the login redirect is special here as running into the error is not like usually intentionally trying a panel route that doesn't exist, but just trying to access a page before logging in that then got renamed. I don't think redirecting the user to a big error view instead of an error dialog is the solution here.

@lukasbestle
Copy link
Member

lukasbestle commented Aug 18, 2025

I really think it is. Let's say the following happens:

  1. User A shares a direct Panel page link with a colleague B.
  2. Before user B can access the link, user A renames the page.
  3. User B clicks the link.
    a) They are already logged in and are presented with the error view. They will know what happened and can ask their colleague if the link is broken.
    b) They are not already logged in. With this PR, they will land on the site view and be confused.

What I'm asking is: Why should case 3b) be different from case 3a) just because the user was not already logged in?

@bastianallgeier
Copy link
Member

I think we have a couple problems here that add up:

  • The error dialogs for redirects are bad. We should show the error view instead.
  • But our error pages in the panel are also pretty bad. If I end up on a page route for a missing page, we could massively improve the experience by having a custom error view that says something like … "This page seems to have been moved or no longer exists. Go to the parent page, Go the site overview, Search for the page, etc."

@distantnative distantnative modified the milestones: 5.1.0, 5.2.0 Aug 18, 2025
@distantnative distantnative marked this pull request as draft August 18, 2025 20:12
@distantnative
Copy link
Member Author

Closing this as it seems to be a dead end based on the feedback

@distantnative distantnative deleted the fix/6682-panel-login-redirect-404 branch November 15, 2025 14:55
@distantnative distantnative removed this from the 5.2.0 milestone Nov 15, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

Panel not opened after login when page doesn’t exist

4 participants