-
-
Notifications
You must be signed in to change notification settings - Fork 184
fix: Only redirect to valid URLs after Panel login #7496
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
774d8b2 to
ba6a249
Compare
ba6a249 to
1226898
Compare
bastianallgeier
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Since this is calling the route already, couldn't this cause some side effects if the route would actually execute something? It could also have quite some performance hit for more complex routes. Checking for false is probably also not enough when routes could return error response objects instead. I'm not sure if we could solve it differently, but I'm a bit worried about the implications.
|
@bastianallgeier I get the concerns, let's try to dissect it a little:
|
|
We could also skip calling the route for common routes we know will work by this point (e.g. site). |
lukasbestle
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I agree with Basti that it's risky to call route code in a method called hasAccess. Even if our views don't have side effects, we cannot guarantee it in the future and also for plugin views, so this is a risk that could become a security vulnerability later.
Trying to understand why the old code didn't already cover this: There must be a fallback route for non-existing views that returns false, right? Couldn't we add a flag to it that can be easily detected without calling the route action?
|
I like @lukasbestle' idea. Maybe we could make sure to always throw a NotFoundException in our error routes and catch that? |
|
The case here is that we want to specifically handle the remembered redirect after the login. The suggestion would mean we just always redirect to site if a Panel route is not found without an error message. Not just after login. |
|
Forget my comment. We would still need to run the route action for what I suggested. I mix things up in my head here. |
|
Trying to approach this from a different perspective: Do we even want to silently redirect to the site view on a "page not found" error? If I'm already logged in and try to visit a page view of a non-existing page, I get a proper view with the error message. From there I can navigate to whatever other view I want, so I'm not lost. Could we do the same with the redirect after login? So instead of displaying the error in a dialog on the login view, we would perform the redirect to the provided URL and display the |
|
@lukasbestle good point. The error dialog is definitely weird here. I had that in different scenarios where it really bothered me. So this is something that we should definitely fix - independently from the login redirect issue. If a redirect leads to an error view, the redirect should go through and not lead to the error dialog. |
|
I think the login redirect is special here as running into the error is not like usually intentionally trying a panel route that doesn't exist, but just trying to access a page before logging in that then got renamed. I don't think redirecting the user to a big error view instead of an error dialog is the solution here. |
|
I really think it is. Let's say the following happens:
What I'm asking is: Why should case 3b) be different from case 3a) just because the user was not already logged in? |
|
I think we have a couple problems here that add up:
|
|
Closing this as it seems to be a dead end based on the feedback |
Description
How to test
Changelog
🐛 Bug fixes
Panel not opened after login when page doesn’t exist #6682
For review team