If you are using a module like tac_lite, and have a linkit link from an anonymously available page contents to other content which requires additional login to access, then the linkit canonical path is kept as node/9999 instead of using translating to the url alias.

CommentFileSizeAuthor
#2 2871327-2.linkit.Links-to-secured-pages-do-not-get-the-url-alias.patch727 bytessingularo
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

singularo created an issue. See original summary.

singularo’s picture

singularo
Location Adelaide, AUS
CreditAttribution: singularo at University of Adelaide commented
Issue summary: View changes
FileSize
2871327-2.linkit.Links-to-secured-pages-do-not-get-the-url-alias.patch727 bytes

Attaching patch that uses the path alias manager to retrieve the alias so that the destrination link is always the path alias url.

anon’s picture

anon
Primary language Swedish
Location Gothenburg
CreditAttribution: anon commented

I see the problem here, but I'm not sure if we should handle this.

If a user don't have access to the target page, and we transform the href to an alias, we would expose data that should be protected.

Wouldn't this introduce a security issue?

pingers’s picture

pingers CreditAttribution: pingers as a volunteer and at University of Adelaide commented

This is no worse than how linkit already works.

E.g.

  1. Create and publish "page A"
  2. Create "Page B"
  3. Add link on "page B" to "page A" using linkit
  4. Unpublish "Page A"

Result: The alias to an unpublished (403) page is disclosed to anonymous users.

Treating urls as "private information" is a bit weird. However, I can see a use case where you have an unpublished page, E.g. /iphone-8-available-2017-05-01, you wouldn't want that to return 403.

mark_fullmer’s picture

mark_fullmer
he/him
Primary language English
Location Tucson
CreditAttribution: mark_fullmer as a volunteer and at University of Texas at Austin commented
Status: Active » Closed (outdated)

This branch of the Linkit module is no longer under active development, and this issue hasn't seen any comments in 6 years.

In order to help the community and the module maintainers focus work on the issues for this module that are most important to the Drupal community, I'm going to close this issue.

If the community feels this is in error, we can re-open it.