trusty-cms icon indicating copy to clipboard operation
trusty-cms copied to clipboard

Include site_id query param in all actions

Open fitzgerald opened this issue 1 year ago • 1 comments

When using multisite, users can do some actions (like 'cancel') that redirects to the root of the admin site (/admin/pages). If the site_id query param is not included, they are not authorized to view the root. This forces a logout.

To Reproduce Steps to reproduce the behavior:

  1. Make sure caching is disabled
  2. Go to a page in the admin section that is not a child of the root (I could repro this best by selecting a page from all productions.
  3. Hit 'cancel' (which redirects to root with no site_id)
  4. Select a page to edit
  5. Hit 'save changes'
  6. This sometimes redirects the user to /admin/pages with no site_id, which pushed them to the login screen

Expected behavior Ideally, we would include the site_id in any link to /admin/pages

Additional context I don't know why, but this seemed to happen more often when I was using the www version of the site than the non-www.

fitzgerald avatar Nov 08 '23 18:11 fitzgerald

It looks like if the user is switching around somewhere along the lines if there is no query param and no session[:site_id] of the site it is failing to lookup the site and then logging the user out.

danigirl329 avatar Nov 13 '23 20:11 danigirl329