adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

http redirect for forbidden guest access #453

New Issue
Closed
opened 2026-10-04 23:59:26 +02:00 by adam · 4 comments
adam commented 2026-10-04 23:59:26 +02:00
Owner
Copy link
Copy source

If $conf['guest_access'] is false, we'd better perform an http redirect and not an html redirect.

If $conf['guest_access'] is false, we'd better perform an http redirect and not an html redirect. <!-- github-sync-id:153117551 -->
adam closed this issue 2026-10-04 23:59:26 +02:00
adam commented 2026-10-04 23:59:27 +02:00
Author
Owner
Copy link
Copy source

@plegall, Can you try this on as many browsers as possible ? I'm not sure all browsers follow the http header redirects if status code is 401 (the http protocol specify it for 3xx status codes but not for 401)

@plegall, Can you try this on as many browsers as possible ? I'm not sure all browsers follow the http header redirects if status code is 401 (the http protocol specify it for 3xx status codes but not for 401) <!-- github-comment-id:222450944 -->
adam commented 2026-10-04 23:59:28 +02:00
Author
Owner
Copy link
Copy source

@modus75 you're right. I even think that the HTTP code automatically becomes 302 when redirecting. You can't have a redirect and code 401, it is not logical.

So I propose to set_status_header(401) only when we do no redirect (the first case of access_denied). Do you agree?

@modus75 you're right. I even think that the HTTP code automatically becomes 302 when redirecting. You can't have a redirect and code 401, it is not logical. So I propose to set_status_header(401) only when we do no redirect (the first case of access_denied). Do you agree? <!-- github-comment-id:222460267 -->
adam commented 2026-10-04 23:59:29 +02:00
Author
Owner
Copy link
Copy source

It's ok with me (because I don't use this case), but it's somehow strange to redirect in case of authorization error...

It's ok with me (because I don't use this case), but it's somehow strange to redirect in case of authorization error... <!-- github-comment-id:222470077 -->
adam commented 2026-10-04 23:59:29 +02:00
Author
Owner
Copy link
Copy source

the idea behind guest_access=false is to force connection. Whatever the page the visitor tries to open, he is redirected to identification.php as long as he is not connected. Including the home page.

the idea behind guest_access=false is to force connection. Whatever the page the visitor tries to open, he is redirected to identification.php as long as he is not connected. Including the home page. <!-- github-comment-id:222475415 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#453