Add gatekeeper protection
spatialed opened this issue · comments
@spatialed could you describe this a bit more? The pages of this plugin already use gatekeepers
I was able to view the translate pages without logging in until I protected them with my own gatekeeper. While I could not edit those pages, I could still access them directly to see plugins and other info.
@spatialed that should not be possible. The pages of translation editor are protected with a gatekeeper. There is however an other issue. Normal (logged in) users can access the translation editor pages, but not edit translations
community.elgg.org/plugins/385116/1.3/translation-editor#item-annotation-5754272
I am concerned about the security. This is perhaps an stupid observation, Im not an Elgg expert. I could access Translation Editor with a non-admin user, just writting down the URL in my browser (www.mysite.com/translation_editor). Is that an expected behavior? Looking at the code, the page handler is always registered, regardless of the user.
community.elgg.org/plugins/385116/1.3/translation-editor#item-annotation-6099264
same as David above, the link is readable even if the user is not set as translator but can not save translations so it's still safe but not being even readable would be best I guess.
this is fixed for the Elgg 1.9 release of this plugin