[Gelöst] Access is not restricting content to Page
This support ticket is created vor 12 Monate. There's a good chance that you are reading advice that it now obsolete.
This is the technical support forum for Toolset - a suite of plugins for developing WordPress sites without writing PHP.
Everyone can read this forum, but only Toolset clients can post in it. Toolset support works 6 days per week, 19 hours per day.
No supporters are available to work today on Toolset forum. Feel free to create tickets and we will handle it as soon as we are online. Thank you for your understanding.
Tell us what you are trying to do?
Restrict access to hidden link. The page remains accessible to all visitors.
This staging site uses BASIC AUTH.
User: flywheel
Pass: chivalrous-victory
You have created a Post Group and added a particular page (Employee Portal) to it, and denied read access to guest visitors.
Visiting the page on the front end as a guest, the page content can be seen.
Correct, yes?
I tested the same on my local site and it is working with the current plugin versions (I don't have any debug info for you, but trust you have the plugins up to date).
The content on that page, it is just regular content inserted in the page rather than some content that is injected by some 3rd-party plugin?
Can you test a couple of things?
1. currently it looks like you have set a content template to be displayed to users without access. What happens if you change that to display a 404?
2. what happens if you add some vanilla page (I'm think Sample Page, something similar) to the Post Group and try visiting that page?
If that doesn't reveal anything I'd ask you to test on a minimal install, disabling all non-Toolset plugins and switching theme to twentytwentyone.
> Visiting the page on the front end as a guest, the page content can be seen.
Yes. Guests can see the content of the page.
> I tested the same on my local site and it is working with the current plugin versions (I don't have any debug info for you, but trust you have the plugins up to date).
Yes, they are current.
> The content on that page, it is just regular content inserted in the page rather than some content that is injected by some 3rd-party plugin?
There is no third party plugin injecting on that page. That site does use Oxygen Builder.
> 1. currently it looks like you have set a content template to be displayed to users without access. What happens if you change that to display a 404?
No difference with the original (/employee-portal) page.
> 2. what happens if you add some vanilla page (I'm think Sample Page, something similar) to the Post Group and try visiting that page?
Interestingly a new page will hide content with the 404 setting.
The new page content will appear if I select Show Content Template.
It looks like one may be able to use "Show Page template". If I do that I get a php file not found which probably shouldn't be possible as the dropdown clearly was able to find it? Not really concerned with that as a solution though.
> If that doesn't reveal anything I'd ask you to test on a minimal install, disabling all non-Toolset plugins and switching theme to twentytwentyone.
I set up a new instance with just Toolset and Twenty Twenty-Three. All pages are new obviously. The 404 setting will hide the content. Choosing "Show Content Template" will show the page that should be hidden (like above).
Looks like there is a bug with using "Show Content Template"?
I have tried it in a fresh WP installation, it works fine.
See below sandbox website:
Login URL: hidden link
1) Dashboard-> Toolset-> Access Control-> Post types, in section "Pages": hidden link
enable option: Managed by Access
disable option: "Read" capability of role "Guest", and show a content template "No access to this page"
2) Dashboard-> Toolset-> Access Control-> Posts Groups: hidden link
add an item "Guest", enable option: "Read" capability of role "Guest",
3) Create a page: hidden link
in section "Post Group", choose above post above group "Guest"
Test it in frontend: hidden link
I can see the page contents correctly as a guest.
Is there any missing steps? can you reproduce the same problem in above test site?
Thanks Luo, what you described appears to be the inverse of my use case OR I am thoroughly confused.
My Use Case ---
My use case is that I want select pages not to be available to the general public (Guest). For now that can mean any unauthenticated user. To keep things tidy I chose to create new Custom Role of "Employee" based on the Subscriber role.
Your example ---
You example seems to show that no pages are blocked.
Visiting any page incognito (not logged in) succeeds. I am never show the Content Template "No access to this page".
I am confused and it seem contrary that on Access Control > Post Types > Pages > Unchecked "Read" for Guest. Should that not block ALL Pages to the public (Guest)? Yet I can go to any page and still see it. I used the home page initially but then created a new page hidden link not assigned to any post group and found that it is accessible in an incognito window.
My example (on your sandbox) ---
I added the Custom Role of "Employee" (based on Subscriber).
Created a Post Group "Employees".
Created a new Page hidden link that is assigned to Post Group "Employees".
Visiting that page incognito I get a 404. Good but suboptimal. I'd want to give them a login form or a link to it.
Change Acceess Control > Post Groups > Employees > Pencil Icon and select Content Template "No access to this page"
Visiting the above page incognito I see the content, not the Content Template, not 404. This would appear to be a bug.
I have tried it again in the sandbox website:
1) Switch to WordPress default theme 2021
2) test the URL you mentioned above as guest: hidden link
I see below message: No access to this page
It is displaying the content template: hidden link
