Hi there,

In the right hand sidebar of our website, is a simplenews subscription pane, which is being cached, despite the panel pane being set to "no caching."

As a result, when a user logs in, the pane is not detecting that the user is logged in, and presents the text box for the user to enter their email address. This should normally be automatically populated.

More worryingly, if I flush the drupal cache, and then view the site as a logged in user, when an anonymous user subsequently views the page, they see the simplenews pane displaying the username of the user who first created the cached page. This exposes usernames to unauthenticated visitors.

Comments

ukcolumn’s picture

It seems the issue is broader than I had originally thought. For example, I have a primary links menu changing based on whether the user is logged in or not using the "account menu" module. But the state of that menu is being cached.

I also have Ubercart installed, and the price by role module installed. The aim is to discount product prices based on whether the user is logged in or not. But the price of the product is not changing because the product view is being cached despite caching being switched off in the view and on the panel pane.

If we take the menu issue above as an example, if a non-admin user logs in, the menu gets stuck on "log in" instead of changing to "My Account" and "Log Out".

But if I clear the Drupal cache manually, the menu changes as expected.

And then, if the non-admin user logs out, the menu stays stuck in the logged in state.

So it seems that site wide, there is an issue of content which should not be cached at all, or which should change when a user logs in, is being cached aggressively.

None of the above seems to happen for user 1.

Can anyone suggest where to look for a solution to this? I'm not seeing the same problems with standard Drupal installs.

fabsor’s picture

Hi!

I think you should go into panels (admin -> build -> pages), go into the site template, and try disabling caching on the menu. You can disable caching on each pane specificly and come up with a solution that works for you.

ukcolumn’s picture

Thanks for the reply, but I have caching disabled - method set to "no caching" for individual panes.

Let me explain a different way. Say, for example, I open the site in Opera and log in as an admin. I manually clear the cache.

In Firefox, I'm logged in as a non-admin user. I refresh the front page, and the Simplenews pane now displays my username with an "unsubscribe" button underneath, as it should.

In Chrome, I open the front page of the website as an unautheticated user, and I see the Simplenews pane with the Firefox user's username, and an unsubscribe button underneath. This is not correct - this user should see a text box for entering an email address, and a subscribe button. This user should definitely not see the username of another user of the site.

The only way to change the contents of the pane is to clear the Drupal cache again.

I don't understand why the panel pane is being cached at all, when the pane cache is disabled. In other cases, for example the "latest posts" pane, which is not being updated when new blog posts are added until the Drupal cache is cleared, both the panel pane and the view are set to not cached.

This is quite puzzling, very annoying. Maybe I'm missing something very simple, but sometimes when you're staring at something for long enough, you become blind to the obvious, so apologies if that is the case here.

ukcolumn’s picture

I guess from the activity on here that you are concentrating on the Drupal 7 version and aren't interested in looking at this problem. Its a shame because this behaviour is a real deal breaker for me.

I'm now evaluating OpenPublish, and it looks like that's the way I'll go - a pity because I think I like the way things are done in Nodestream a little better.

josepvalls’s picture

FYI
I don't think this issue is about NodeStream but a more general panels issue.
I stumbled into this post but my panels are views panes.
I will keep researching.