Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change login page message when user has been redirected after auth failure #14829

Merged
merged 20 commits into from Oct 2, 2019

Conversation

katebutler
Copy link

Fixes #14706

@katebutler katebutler added the Needs Review PRs that need a code review label Aug 28, 2019
@katebutler katebutler added this to the 3.12.0 milestone Aug 28, 2019
@tsteur
Copy link
Member

tsteur commented Aug 29, 2019

@mattab could you have a look at this one?

@mattab
Copy link
Member

mattab commented Sep 10, 2019

Does not work for me, here is what i did:

  • Set login_session_not_remembered_idle_timeout = 30

  • Login without remember me

  • Wait 40 seconds

  • Click refresh on a widget, saw:
    Screenshot from 2019-09-10 11-15-34

  • Reload page, saw:
    Screenshot from 2019-09-10 11-17-32

Expected to see the correct message instead.

@tsteur
Copy link
Member

tsteur commented Sep 10, 2019

@mattab I think it was in the issue referred to the main page. Should be possible to change it there too. Anyway, what we were wondering was re the message that we're showing that this will be fine. also see the comments in the issue.

@tsteur
Copy link
Member

tsteur commented Sep 15, 2019

@mattab can you have a look at the message etc?

@mattab
Copy link
Member

mattab commented Sep 16, 2019

Within a widget getting: Screenshot from 2019-09-16 22-09-10

Expected to see a more clear message if possible?

Then when clicking again on "Dashboard", getting the old message as reported in #14706

session_timeout

The point of fixing #14706 was to display a more clear message, maybe it's not working as expected or is the message not improved?

# Conflicts:
#	plugins/CoreHome/angularjs/widget-loader/widgetloader.directive.js
@tsteur
Copy link
Member

tsteur commented Sep 16, 2019

@katebutler can we change the message to Please log in to access this functionality? And then we make sure it works in all cases.

katebutler added 3 commits September 18, 2019 08:09
core/Access.php Outdated
Piwik::checkUserIsNotAnonymous();
} catch (NoAccessException $ex) {
// Try to detect whether user was previously logged in so that we can display a different message
if (isset($_SERVER['HTTP_REFERER']) && strpos($_SERVER['HTTP_REFERER'], SettingsPiwik::getPiwikUrl()) === 0) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fyi $referrer = Url::getReferrer()

fyi Url::isValidHost(Url::getHostFromUrl(referrer))

core/Access.php Outdated Show resolved Hide resolved
@tsteur
Copy link
Member

tsteur commented Oct 1, 2019

@@ -258,6 +259,10 @@ public function disable()
public function checkIsEnabled()
{
if (!$this->isEnabled()) {
// Some widgets are disabled when the user is not superuser. If the user is not logged in, we should
// prompt them to do this first rather than showing them the "widget not enabled" error
Access::getInstance()->checkUserIsNotAnonymous();
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wondering if that could make problems if a site is set as accessible for anonymous user, but e.g. the dashboard contains a widget that is disabled (for any kind of reason)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Was thinking about that as well @sgiehl but it should be actually fine since it goes only in here when the widget is disabled. In this case the user would need to log in to see a more accurate message. We basically don't want to show that message then and also in general a user would actually not really get to see a disabled widget in the first place maybe (unless opened maybe directly not sure)

@tsteur tsteur merged commit 378c403 into 3.x-dev Oct 2, 2019
@tsteur tsteur deleted the 14706 branch October 2, 2019 03:01
@mattab mattab added the not-in-changelog For issues or pull requests that should not be included in our release changelog on matomo.org. label Oct 25, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Needs Review PRs that need a code review not-in-changelog For issues or pull requests that should not be included in our release changelog on matomo.org.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

More informative session expiry message
4 participants