0

We user several plugins that export the current entry via buttons in the Admin CP. One plugin exports the entry as a PDF and another downloads it as HTML along with its assets in a zip.

I need to add {% requireLogin %} so that the entries are no longer public and require users to be authenticated to view.

However, I'm finding that plugins don't appear to have the current users authentication status and capture the login page. For example, the PDF plugin downloads a PDF of the login page and the HTML Page exporter plugin exports the HTML of the login page as well.

Is there away to prevent public access to the world, but still allow plugins to capture the pages as if they were authenticated?

Currently running Craft 3.7.44 on php 8.

Improve this question
3
  • The login status is independent of which plugin or module is executing a request. I think it's more likely to be related to how you're creating your PDF and HTML exports. Do the plugins just perform a web request to get the contents of the page? In this case, those request will be unauthenticated because they won't include the session cookie. One way around this would be to render the template for the given entry directly instead of using a separate web request.
    – MoritzLost
    Jun 8 at 7:55
  • The plugins were purchased from the Craft Plugin store, so I'm not exactly sure what they are doing under the hood. I'll poke around in them today a bit. It sounds like if they are using a web request I will end up having to open an issue with the plugin developer. But in the mean time, is there anything that could be done with an if statement to determine a local web request and bypass the authentication?
    – Christopher DuCharme
    Jun 8 at 12:56
  • Can you link to the plugins? Would be interesting to see how they work under the hood. In any case, if they do use unauthenticated web requests to get the entry contents, check if there's some way to modify those requests. If there is, you can add something like a access token and check for that in your template, allowing it to bypass the login requirement. Though you'll need to be careful not to accidentally create a backdoor. Maybe check with the plugin authors first, see if this is a known issue or if they have any existing solutions to this problem.
    – MoritzLost
    Jun 9 at 14:26

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.