Avoiding the Error page

I’m trying to test sending anonymous users to the unauthorized page instead of the error page.

I’ve given them load permission in the web context with a context access ACL entry, but they’re still getting sent to the error page when accessing a protected resource.

A snippet on the error page with hasPermission(’load’) confirms that they have load permission, but they’re still not getting the unauthorized page. I’ve flushed permissions and sessions and cleared the cache and I’m testing in a separate browser, but it still won’t work. I don’t know what I’m doing wrong. "Load" is the only permission they have -- do they need something else?

Quote from: BobRay at Feb 08, 2010, 01:02 AM

I’ve given them load permission in the web context with a context access ACL entry, but they’re still getting sent to the error page when accessing a protected resource.

If they are protected by a Resource Group ACL, that’s not gonna help at all. This is about loading a Resource protected by a Resource Group, not a Context. You have to create a Resource Group ACL with load permission for anonymous users.

see: http://svn.modxcms.com/jira/browse/MODX-1614

About granting ’load’ permission to anonymous - the idea is clear and "correct" but it requires some enhancements in other modules, for example:
a. wayfinder - will now list resources that are private.
b. ditto will list and show (bug?) the private resources.

This makes sense, but it limiting. In my case, for example - I wanted private pages to give back "unauthorized page", but still not expose them (or list them) until login.

This can be resolved from the module’s side (more granolar use of haspermissions/checkpolicy) - but maybe better to resolve this in the core level (another permission lower then ’load’ for makeurl?)

In my case - i reverted back to using 404 (ie. no load permissions for anonymous).

"list" and "view" are the policy permissions that need to be checked by the components to take advantage of the new granular permissions; this should be relatively easy to address.

Quote from: OpenGeek at Feb 08, 2010, 08:49 AM

Quote from: BobRay at Feb 08, 2010, 01:02 AM

I’ve given them load permission in the web context with a context access ACL entry, but they’re still getting sent to the error page when accessing a protected resource.

If they are protected by a Resource Group ACL, that’s not gonna help at all. This is about loading a Resource protected by a Resource Group, not a Context. You have to create a Resource Group ACL with load permission for anonymous users.

My mistake was even dumber than that.

The page *wasn’t* protected by a Resource Group ACL entry, but I was testing by going to index.php?id=n and I was testing it using the wrong n (one for a page that *was* in a protected resource group).