Some internal plugins provide information about the pages targeted by a link. In order to provide proper content security, these plugins will need to make use of node_access() and other access control functions related to the current user. Unfortunately, this does not work with the filter cache on- text would be cached based on a random viewing user without regard for security. Adding a mechanism to disable the filter cache, and a mechanism for overriding by format (#634348: Configuration by Input Format), is simple enough, and already needed for #465360: freelinks don't redirect properly when content is cached.

It is a shame to take some of the most complex features of the Freelinking Plugins, wrap them in extra access control operations, then turn off the cache. I'm exploring some method of giving this a leg up.

Comments

Grayside’s picture

Grayside commented
Title: Plugin Security » Plugins and Content Access

My first thought is to try something with a dummy user to provide a better baseline than "assume zero permissions".

Providing an option to the site administrator to run the filter as though all users were "anonymous", "authenticated", or some other mix of roles seems like the best compromise between dropping the cache and needing to proactively handle role-exempt cases such as OG Access.

Frank Leith’s picture

Frank Leith commented

Hello Grayside,

I hope this is the right spot to ask. I'm working on a Intranet solution. I'm using the Content Acces module and was hoping to be able to use the freelinking module as well. But now I sometimes can't grant users acces to pages created with freelinking. Is there a workaround or do I (for now) have to uninstall the freelinking module?

gr. Frank

Grayside’s picture

Grayside commented

Frank, let's continue that conversion over here: #723558: Content Access & Freelinking.

This thread is for a long term development issue, not bug reports. I appreciate you trying to find the best spot to discuss your problem.

juampynr’s picture

juampynr commented
Status: Postponed (maintainer needs more info) » Closed (won't fix)

Closing. Obsolete.