mahara-contributors team mailing list archive

[Kristina Hoeppner <1702748@xxxxxxxxxxxxxxxxxx>]

Public bug reported:

Checked in 16.10 -> 17.04

When you have a public file on one Mahara site, link that for example in
a journal entry on another Mahara site and make the page public, the
file gets the viewID of that page appended even though there is no
reason for it. It seems that Mahara only checks that
/artefact/file/download.php?file= is present no matter the domain and
then simply appends the viewID.

To replicate:

1. Log into Mahara instance 1.
2. Upload a file into Admin menu -> Configure site -> Files -> Public.
3. Add the file to the public menu (to ensure that you are copying the correct download link that is available to people when not logged in): Admin menu -> Configure site -> Menus -> Public...
4. Copy the file's location. It should look something like http://domain.tld/artefact/file/download.php?file=XXXX
5. Log out of Mahara instance 1.
6. Log into Mahara instance 2.
7. Write a journal entry and link some text to the file. Save the entry.
8. Add your journal to a page and make it public.
9. View the page and hover over the link.

Expected result: The link looks exactly the same as before and you can reach the file as it is a public one.
Actual result: The link has a viewID appended, e.g. http://domain.tld/artefact/file/download.php?file=XXXX&view=YYY and if you are not logged into Mahara instance 1, you can't view it.

** Affects: mahara
     Importance: Medium
         Status: Confirmed

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
Matching subscriptions: Subscription for all Mahara Contributors -- please ask on #mahara-dev or mahara.org forum before editing or unsubscribing it!
https://bugs.launchpad.net/bugs/1702748

Title:
  View ID appended at download URL from another Mahara site

Status in Mahara:
  Confirmed

Bug description:
  Checked in 16.10 -> 17.04

  When you have a public file on one Mahara site, link that for example
  in a journal entry on another Mahara site and make the page public,
  the file gets the viewID of that page appended even though there is no
  reason for it. It seems that Mahara only checks that
  /artefact/file/download.php?file= is present no matter the domain and
  then simply appends the viewID.

  To replicate:

  1. Log into Mahara instance 1.
  2. Upload a file into Admin menu -> Configure site -> Files -> Public.
  3. Add the file to the public menu (to ensure that you are copying the correct download link that is available to people when not logged in): Admin menu -> Configure site -> Menus -> Public...
  4. Copy the file's location. It should look something like http://domain.tld/artefact/file/download.php?file=XXXX
  5. Log out of Mahara instance 1.
  6. Log into Mahara instance 2.
  7. Write a journal entry and link some text to the file. Save the entry.
  8. Add your journal to a page and make it public.
  9. View the page and hover over the link.

  Expected result: The link looks exactly the same as before and you can reach the file as it is a public one.
  Actual result: The link has a viewID appended, e.g. http://domain.tld/artefact/file/download.php?file=XXXX&view=YYY and if you are not logged into Mahara instance 1, you can't view it.

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1702748/+subscriptions