[#6545] Logged-in user gets error when accessing restricted menu item

Hi, I am having a very strange problem in my site. I am using latest versions for Joomla and CB versions. The problem is as follows.

I have a website where most of the articles and menu items are of public access. However, some areas of the site, like the Kunena forum menu item and a “Community Builder userlist” menu item are restricted to only registered users.

I have a CB login module displayed in the main page of the website. I login to the site with the “remember me” box checked. Right after the login, I can see the menu items that are restricted only to registered users - such as the Kunena Forum and the CB userlist – and can even access them by clicking on the menu item. So far so good.

Then I access one of those items and save it as a favorite in the browser, or even copy the address for later. After some seconds I then access the favorite and it is OK, I can see the correct page. However, if I wait long enough (I think it is around 10min) and then do the same thing (that is, access the favorite) then I get the error message “You are not authorized to view this resource" and I am sent to the main page of the website.

But what is really strange is that, after this error, since I am logged in (because I checked “remember me” – even the login module in the main page says so) I can see the restricted menus and can click on them and access the page that previously resulted in the error!

This may sound confusing, so I put a step by step below:

- login to the website using CB login module with “remember me” checked;
- access a menu item (CB userlist or Kunena Forum) that is restricted to registered users and it works fine;
- save the address in favorites;
- close the browser tab where the menu item page is showing;
- access the menu item via the favorites item that was previously saved and it works fine, the page is loaded;
- once again close the browser tab but this time wait 10 min before trying to access the menu item again;
- after 10 min, access the menu item via the favorites item that was previously saved and this time you get the error message “You are not authorized to view this resource" even though I am logged in;
- access the favorite again after a couple seconds and then everything is OK and the page is loaded.

Any thoughts on what might be wrong or where should I look?

Best regards,
Fabio.

Your session was expired when you tried to access the bookmark. Joomla I'm guessing does not handle remember me before it does that access check as it's done after the page has initialized as I understand it. Regardless CB has no control over this. Remember me is entirely handled by Joomla. Our login module simply tells Joomlas login API to remember the session.

Thanks for the reply Kyle. That should give me a hint on where to look for. Since apparently it is not related to the use of CB, it should be a quite common situation and there must be some workaround.

Regards,
Fabio.

I have not figured-out why, but if I disable "Rewrite URLs" under Extensions->Plugins->Community Builder System plugin the problem does not happen.

And you were correct, Kyle, the problem happens if the session expires, as I made some tests changing the time-out period.

Regards,
Fabio.

That might explain a bit then as it maybe Joomlas login page handling the remember me. I've added a bug ticket to look into this further as if that's the case then we need to ensure CBs login page does the same.

forge.joomlapolis.com/issues/6545

Hi,

further investigating, I ran into the the article below and found out that the $live_site parameter in my configuration.php file was blank. So I fixed that.

www.joomlapolis.com/forum/145-community-builder/205459-joomla-sef-and-rewrite-urls

After fixing it, the original problem did not go away (I still cannot access the restricted page directly thru the bookmark), but at least now I am getting some more stable behavior. Now, considering I have checked "remember me", if I access a restricted content in a new window or tab (thru a bookmark for example) after the session expires, that takes me to CB Login module telling me that I need to login first, instead of the previous situation where I was sent to the main page, though logged in, with a small Joomla clickable window reporting the error message “You are not authorized to view this resource" (which was confusing since I was logged in!!!).

Regarding my comment in the previous reply saying "if I disable Rewrite URLs under Extensions->Plugins->Community Builder System plugin the problem does not happen", this has changed behavior as well after the live_site parameter fix. Now, with the live_site parameter properly configured, the behavior with or without "Rewrite URLs" seems to be the same, the only difference is as follows:

- Rewrite URLs enabled -> access to restricted content after session expires takes me to CB Login module telling that need to login first
- Rewrite URLs disabled -> access to restricted content after session expires takes me to Joomla Login module telling that need to login first

I'll keep investigating.

Regards,
Fabio.