[RESOLVED] menu type 'web link submission' ignores access level 'public'

[bikeman]

Problem: menu type 'web link submission' ignores access level setting 'public'

Replicate:
Create new menu item 'submit link' as type 'web link submission layout'
Setting access level = PUBLIC
Browse to front end and click 'submit link' menu
Taken to 403 - Access Denied! page

Public setting should allow access to page.

[Jinx]

Not a bug, know issue.

[mcsmom]

I think that you must be registered to submit a web link.

The problem is that a public menu link is made to a registered location.

The location is still registered, even though the weblink is not.

[bikeman]

If the submit link goes to a registered location and is not available to public users, then the menu type 'web link submission layout' should have the setting access level = PUBLIC grey'd out or removed.

Clearly a user cannot be expected to remember each and every admin setting in joomla that doesn't work/is not supported.

AND

Whether the user is logged in or not makes no difference... all users get sent to 403

[bikeman]

Actually registered users cannot submit web links, only special users can do this. This is probably not how it's intended to work - at least no one has clarified this point previously.

I live in hope that joomla functionality will oneday be specified somewhere and not just vary depending upon the last developer who touches the code.

[mcsmom]

It's supposed to be that registered can submit weblinks and authors and above can submit content.  It even says this in the tool tip when you create the link.

I can confirm that registered users are getting a 404 on  clicking the submit  llink.


components\com_weblinks\views\weblink\view.html.php

// Make sure you are logged in and have the necessary access rights
if ($user->get('gid') < 19) {
JError::raiseError( 403, JText::_('ALERTNOTAUTH') );
return;
}


Shouldn't it be < 30? (stupi)
Shouldn't it be <18


Update:

But also, isn't gid gone and replaced by group_id?

[bikeman]

at last acceptance that there is a problem 

[mcsmom]

No, I don't count for that.

[user deleted]

Hi Elin,

Thanks for looking into this, I'll have a look asap at the code you provided.

[bikeman]

registered users cannot submit web links, only special users can do this.

It's supposed to be that registered can submit weblinks .. It even says this in the tool tip when you create the link.

how exactly dont you agree then?

[moijafcor]

Problem: menu type 'web link submission' ignores access level setting 'public'

Sometime ago, on this post I asked for this Web Link engineering issue to be added as a Feature Request for a full change of its logic. As Elin kindly explained there, the way it works and the issues arisen by its behavior are inherited since the Mambo days.

Sure someday this will be properly redesigned. 

Saludos.

[albenda]

So, is there a fix?  I think I have a similar problem. 
From registered User menu trying to submit a weblink  goes to http://mywebsite.com/index.php?option=c ... &Itemid=52

I get ----  403 - Access Denied!

[Shaella]

So, is there a fix?  I think I have a similar problem. 

I had the same problem, so I edited the code mentioned/suggested above, and that fixed it:

-----------------
components\com_weblinks\views\weblink\view.html.php

// Make sure you are logged in and have the necessary access rights
      if ($user->get('gid') < 18) {
        JError::raiseError( 403, JText::_('ALERTNOTAUTH') );
        return;
      }
---------------

I checked yesterday's nightly build (haven't downloaded last night's yet), and that fix wasn't in there yet, but it's easy to make the change manually for now.

[mcsmom]

Could someone take a look and commit this if it is correct?

This is #7467 in the tracker

[tcp]

Could someone take a look and commit this if it is correct?

This is #7467 in the tracker

Updated in Rev 9462.

Registered users are not allowed to submit articles or weblinks.  This is a known problem that will be addressed in more detail in a future version.  For the time being, I've modified the sample data so that these links are show only for special users and not for registered users.

In reality there needs to be more sophisticated controls about this.  In the short-term, the components com_content and com_weblinks could offer a preference that allows registered users to submit information, but before that happens we really need to look at the code for potential security vulnerabilities.

tcp

[mcsmom]

Well, in reality, since you can set global configuration to make all users authors, if you want to have people submit both, that is fairly simple.