Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

After login, redirect to admin only if user is allowed #1961

Merged

Conversation

jajm
Copy link
Contributor

@jajm jajm commented Oct 24, 2022

By default all roles have access to administration dashboard but modules can change permissions or create new roles that forbid access to it. Users with that kind of role should not be redirected to the admin dashboard, as they will land on an error page (with a confusing "Successfully logged in" message)

This patch verify that the user is allowed to see the admin dashboard before redirecting to it. If the user is not allowed, it will be redirected to the front page

To test:

  • Install https://omeka.org/s/modules/GuestRole
  • Create a user with the role "guest"
  • Log out
  • Go to /login (do not click on "Admin dashboard" link to go to the login form or you will still be redirected to /admin after login)
  • Try to login with the guest user. You should be redirected to the front page
  • Log out
  • Try to login with an admin user. You should be redirected to the admin dashboard

By default all roles have access to administration dashboard but modules
can change permissions or create new roles that forbid access to it.
Users with that kind of role should not be redirected to the admin
dashboard, as they will land on an error page (with a confusing
"Successfully logged in" message)

This patch verify that the user is allowed to see the admin dashboard
before redirecting to it. If the user is not allowed, it will be
redirected to the front page
@zerocrates zerocrates merged commit 13b78cd into omeka:develop Dec 19, 2023
@jajm jajm deleted the redirect-to-admin-only-if-allowed branch December 20, 2023 07:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants