Restrict access of landing pages of one portal to another!!

General
, , , , , ,
1

Hello everyone,

I have a portal (A) which has a set of landing pages defined in the App Studio. I have another portal (B) which has another set of limited landing pages defined in the App Studio.

Now, say, we login and click and open a landing page from portal A and copy the URL from this browser’s session, login and open another browser session with portal B and paste the URL, ideally we shouldn’t be able to access it as it is not a valid landing page for this portal and it’s users. But on the contrast, I am able to open the landing page with the copied URL.

Is there any configuration, to restrict this? We can maybe redirect the user to the homepage if he tries accessing the non-accessible landing page or throw an error-404?

Thanking you in advance for your help!

Regards,

Saurabh.

2

@SaurabhG7134 you have correctly logged a support Incident on this issue in parallel.

We will help track the investigation to see if this is a cosmos react issue.

Our support team are starting their investigation.

Please update this forum post as and when required.

3

@SaurabhG7134

I have gone through INC-235707 to determine what was the final conclusion. I can see that this issue was logged against verssion 8.7.2.

The issue was identified as a portal security shortcoming and an Unsupported feature . You were provided a local change using circumstance rules.

BUG-751800 was converted into an Enhancement request EPIC-78662 created to add privileges to view and data page rule form and checked against user role access by DX API Page and data-view endpoints. The epic was then targeted for 8.8.1

From 8.8.1 onwards, security added for Datapages and Views as shown below.

DataPage:

dp.png
dp.png765×274 72.7 KB

View Page:

vw.png
vw.png1435×517 91.8 KB

Steps to be followed:

  1. Create a privilege for a view Page.

  2. Add that privilege under the view page using the security tab.

  3. Add that privilege to the roles that can access the landing page (where views getting rendered to display the data).

Attached additional details on how to implement the solution.

In January you updated to 8.8.1.

You were informed that you can reopen the support ticket in the unlikely event you see issues after implementing the feature.

I hope that the above information helps other users who experience the same DX API issue.

ViewPrivilege_M-9218687.docx (241 KB)