Posted by pheinrich on January 19, 2008 at 8:59am
| Project: | Secure Pages |
| Version: | 5.x-1.7 |
| Component: | Code |
| Category: | bug report |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | closed (won't fix) |
Issue Summary
Nodes with URL aliases are never matched (whether set manually or via Pathauto). Only a node's original URL may be specified for inclusion or exclusion. For example, if node #50 has a url alias of 'test', the following inclusion list will not protect it:
test
node/add*
node/*/edit
user/*
admin*
user
However, changing the first entry to the original path works:
node/50
node/add*
node/*/edit
user/*
admin*
user
This is not the case for views, whose paths seem to work fine.
Comments
#1
This was a relatively easy fix (assuming I'm not missing something obvious). I've seen others request this functionality; here's my change, in case it helps someone else:
271c271,278
< return !($secure xor preg_match($regexp, $path)) ? 1 : 0;
---
>
> $result = preg_match($regexp, $path);
> if (function_exists('drupal_get_path_alias')) {
> $path_alias = drupal_get_path_alias($_GET['q']);
> $result |= preg_match($regexp, $path_alias);
> }
>
> return ($secure xor $result) ? 0 : 1;
#2
Here's a patch file (against the latest 5.x-1.x-dev) with some changes:
drupal_get_path_aliasshould test the passed value of$pathinstead of$_GET['q']because thesecurepages_matchfunction is used for more than just the current browser URL#3
See also: "Securepages does not work with Clean URLs enabled"
http://drupal.org/node/206864
#4
pheinrich,
Do you plan to incorporate this logic into a future revision of Secure Pages?
#5
This patch works beautifully for me, a lot pages on my site weren't being secured until I installed this patch
many thanks
#6
The patch also worked for me. I applied the patch to securepages-6.x-1.7-beta2 and it fixed my alias problems. Many thanks!
#7
patch at #2 also works for me on drupal 6. Can we get this committed in both version please?
#8
Bump, this patch is still not committed to 5 head.
#9
I too have had need to apply this patch to 6.x-1.7 (release, not beta) to make Secure Pages work like I expect.
#10
Please apply this patch to the latest versions. It worked perfectly and allows the functionality that should be there. Thanks a bunch!
#11
Thanks I have committed this to dev
#12
Thanks for committing this to the 6.x branch. Can we get it committed to 5.x as well?
The patch was actually written against the 5.x branch. I just tested and it still applies cleanly with some line offset.
#13
For reference: I think http://drupal.org/node/206864#comment-2649468 is related to the the change that was made in this patch.
#14
The 5.x branch is no longer supported. If this issue is still present in a current version of Secure Pages, please update the issue summary, change the version field, and re-open the issue.