Details
-
Type: Improvement
-
Status: Closed
-
Priority: Major
-
Resolution: Fixed
-
Affects Version/s: 5.10.0-b2
-
Fix Version/s: 5.11.0-b1
-
Component/s: Client Interface
-
Labels:None
Description
We show the same message when accessing a page within the admin area and the client area. If you try to access something you don't have permissions to, you get the following error on a page of its own:
You are not authorized to access that resource.
Consider the following case:
A client creates a contact. That contact has its own login but doesn't have permissions to "Order". The contact visits the order form (while not authenticated) and attempts to place an order. Upon logging in, they see the message "You are not authorized to access that resource.". This happens because we don't know they don't have permission because it's a public page. Once they log in, we know they shouldn't be able to access it.
We want to handle things different for Clients/Contacts/Managers from Staff. Staff would continue to work as it does now, but if you're a Contact or Manager and you don't have permissions we will:
1. Redirect the user to the client Dashboard.
2. Within the Dashboard, display an error box consistent with normal errors, with a different message. The message for Contacts/Managers when an ACL permission error occurs should be:
Your user does not have permissions to access this, please contact the primary account holder to request access.