Repository navigation
Require a role in the weblog for page and resource previews - #223
Conversation
snoopdave
left a comment
snoopdave
left a comment
There was a problem hiding this comment.
🤖 GLM: PR-Review — 1 inline comment posted.
|
🤖 GLM: PR-Review — General Issues The following issues were found but cannot be attached to a specific line in the diff:
Strengths (not action items): returning 404 rather than 403 avoids telling an unauthorized caller the weblog exists, and the servlet-level placement covers both the page and resource preview paths with tests at each. |
|
🤖Claude: fixed by adding a CHANGES.md entry under 6.1.7 behaviour changes (a9a97c5). |
mraible
left a comment
mraible
left a comment
There was a problem hiding this comment.
Verified this narrows preview access to members of the weblog and excludes pending invitations. The focused tests pass. LGTM.
snoopdave
left a comment
snoopdave
left a comment
There was a problem hiding this comment.
The check is in the right place in both servlets. Some improvements inline.
PreviewAccess.canPreview uses Weblog.hasUserPermission and logs a refusal at debug level. Both preview servlets call it. A doGet test covers the page preview servlet, and PreviewAccessTest adds a pending-invite case.
…g-role # Conflicts: # CHANGES.md
…g-role # Conflicts: # CHANGES.md
Previews show unpublished content, so
PreviewServletandPreviewResourceServletnow return 404 unless the user is enabled and has a role in the weblog being previewed (any of Limited, Author or Admin). Global admins can still preview any weblog.Tests:
PreviewServletPermissionTest(new) and two new cases inPreviewResourceServletTest. Full build and tests pass on JDK 11.