Add page access checks to cache

Description

The cache can contain restricted content. Add a page access check to protect included content with the same restrictions it has on the page that it is excerpted from.

STEPS TO REPRODUCE:

  • Disable ME caching in ME admin tool

  • Create a ME on a restricted page (only admin can view, nobody else can)

  • Create an ME Include on an unrestricted page

  • View this unrestricted page as admin user, see the included restricted content

  • Use incognito browser to login as nonadmin user, view the unrestricted ME Include page, do NOT see any restricted content (because it is not in the cache and user can't access the restricted page to get its excerpt body

  • In admin session, enable ME caching in ME admin tool and hit the unrestricted ME Include page to put into cache

  • In nonadmin session, refresh unrestricted ME Include page: they CAN see the restricted content

WORKAROUND:

Freshdesk Tickets

None

Create a Support Ticket

Activity

Show:
Ture Hoefner
April 14, 2020, 1:40 AM

Fixed in 5.4.0

Answered
Your pinned fields
Click on the next to a field label to start pinning.

Assignee

Ivan A.

Reporter

Ture Hoefner