saltcorn / saltcorn

Free and open source no-code application builder
https://saltcorn.com/
MIT License
1.7k stars 293 forks source link

Home page with user access role presented to public before login #2845

Open yoson7 opened 5 days ago

yoson7 commented 5 days ago

I just notice now that my home page is visible to everybody without login, even though it set to minimum read for "user" role, This can happen if I configure it to be root page for public. Seams like that if you set it as root page for specific role, it brakes the role access limit for the page and all the views it contains.

glutamate commented 5 days ago

Thanks. view have been fixed in #2841. I'll think about what to do with pages in the case of this conflicting configuration. Ideally you should only be able to pick pages with the right access level. There is a similar problem if you have set login view which has higher role to access