trusty-cms
trusty-cms copied to clipboard
Include site_id query param in all actions
When using multisite, users can do some actions (like 'cancel') that redirects to the root of the admin site (/admin/pages). If the site_id query param is not included, they are not authorized to view the root. This forces a logout.
To Reproduce Steps to reproduce the behavior:
- Make sure caching is disabled
- Go to a page in the admin section that is not a child of the root (I could repro this best by selecting a page from all productions.
- Hit 'cancel' (which redirects to root with no site_id)
- Select a page to edit
- Hit 'save changes'
- This sometimes redirects the user to /admin/pages with no site_id, which pushed them to the login screen
Expected behavior Ideally, we would include the site_id in any link to /admin/pages
Additional context I don't know why, but this seemed to happen more often when I was using the www version of the site than the non-www.
It looks like if the user is switching around somewhere along the lines if there is no query param and no session[:site_id] of the site it is failing to lookup the site and then logging the user out.