-
Notifications
You must be signed in to change notification settings - Fork 130
Description
-
If i have a {layout='group/_layout1'} ,
that has only access for members,
then the no-access redirect on the layout doesn't work
(it just shows a blank page). -
in general the no-access redirect is unclear,
as it does not do a redirect but show the other content in place (see below)
Clarification
// template group/_layout1 (Access: members only, no-access redirect: group/nope)
info: {layout:contents}// template group/test (Access: all)
{layout='group/_layout1}
Hello world// template group/nope (Access: all)
Nope-
Bug
When logged in and visiting group/test you get,info: Hello world
When logged out (e.g. private window) you get a blank page
Expected output,Nope(due to the no-access redirect on layout)
(When setting no-access on group/test template, then the "nope" is shown, it does not work for layouts) -
in-discrepancy
In general, the template setting "No access redirect" has unclear wording.
It redirects the "template-engine" to use and show another template in its place,
instead of redirecting the "user" to another group/template as the wording suggests.
It just serves the group/nope content on group/test url with a 200 headerWhat is expected, depends on the programmers intention
- 403 / 200 shown in place on current uri (e.g. content with link to login-page)
- 302 redirect to another page (e.g. http redirect to login-page)
- showing 404 content in place almost never seems adequate, because the resource does exist but has access restrictions