issues using url_aliases for content
| Project: | Path Access |
| Version: | 4.7.x-1.x-dev |
| Component: | Code |
| Category: | feature request |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | by design |
Jump to:
i've come accross the following issue.
i have a site that has a static menu structure and uses url_aliases to view content via either pages or views.
i would like to allow anonymous users access to the aliased sections [ ie 'commercial*', 'residential*' ], but not to access the nodes directly [ ie 'node/10' ].
the reason for this is that i have a different theme for each aliased section [ via taxonomy_theme - extended option ], and want to lock anyone who is not a admin user from seeing the non-styled 'generic' theme which shows up for paths like 'node/10' or 'node/10/edit'
background is that 'node/10' has a url_alias set to 'commercial'
for the anonymous user if i say 'access every page except the listed pages' and list the following
admin*
node*
user*
then i can still access 'node/10', but i cannot access 'node/' or 'node' or 'admin' or 'user'
if i set the list to the following
admin*
node*
user*
commercial*
then i cannot access 'node/10', but of course cannot access 'commercial'
there seems to be an issue around the usage of 'url_alias' and path_access.
please let me know if you require any more information.
#1
Path_access converts any aliased url name back to it's raw system path. This is done for security reasons to prevent "clever" people from trying to get around the path access by using a raw node/id path.
Doing what you suggest would mean the majority of users would have to add permissions for their urls in both the aliased format, and then the raw node/id format - a lot of work.
I'm open to suggestions of how this sort of feature can be added. Until then it's by design.
#2
thanks for the reply.
i'll see if i can think of any solutions that may be interesting to discuss.
#3
as 4.7 version does the path_access.module really require the path.module? I'm using it without path.module and no problems have occured.
if this dependency is over there should be some changes in readme and install files.