Unauthorized Page Procedure

34 Posts

iTristan Reply #1, 14 years, 5 months ago

Hello,

We're a bit confused about the unauthorized page procedure.

We have a 3 context site (not including web).

In the context that is about to go live we have a number of member only pages that are successfully accessed if a user logs in.

However, there are links to pages in the public pages of the site that go to protected pages. What we want to happen:

1. If the user is logged in and has permission to view that page, they see the page when they click the link.
- This works as expected

2. If the user is not logged in, the user will be thrown to a login page where the user logs in and upon success is redirected to the page they had clicked through
- What happens now is they are redirected to the 404 page not to the unauthorized page

In this context settings we've setup an Error Page (key: error_page), value 4, and it works successfully for 404s.
We also setup a setting_unauthorized_page (key: unauthorized_page), value 8, but it does nothing as noted above, we get the 404 page.

Is there something we are doing wrong?

24,544 Posts

BobRay Reply #2, 14 years, 5 months ago

If a user isn't authorized to see a page, it doesn't exist for the user as far as MODX is concerned, so you always get the "page-not-found" page.

There are two solutions:

The easiest, IMO, is to just put this snippet in the template for those pages:

[[!CheckStatus]]

<?php
/* CheckStatus snippet */

if (! $modx->user->hasSessionContext($modx->context->get('key'))) {
    $modx->sendUnauthorizedPage();
}

return "";

If you'd rather not use the unauthorized page, you can do it this way (where $loginId is the ID of the Login page):

[[!CheckStatus? &loginId=`12`]]

<?php
/* CheckStatus snippet */

if (! $modx->user->hasSessionContext($modx->context->get('key'))) {
    $url = $modx->makeUrl($scriptProperties['loginId'], "", "", "full");
    $modx->sendRedirect($url);
}

return "";

The other solution is described here http://bobsguides.com/revolution-permissions.html (see the "Unauthorized Versus Error Page" section).

------------------------------------------------------------------------------------------
PLEASE, PLEASE specify the version of MODX you are using.
MODX info for everyone: http://bobsguides.com/modx.html [ed. note: BobRay last edited this post 14 years, 5 months ago.]

Did I help you? Buy me a beer
Get my Book: MODX:The Official Guide
MODX info for everyone: http://bobsguides.com/modx.html
My MODX Extras
Bob's Guides is now hosted at A2 MODX Hosting

34 Posts

iTristan Reply #3, 14 years, 5 months ago

Thanks. We added a Load only permission and made a custom snippet to redirect individuals who have a profile page (that they can edit) directly to that page and then users who can only view protected pages to the protected pages section.