[TikiWiki-commits] [Git][tikiwiki/tiki][master] [FIX] UAB: Anonymous/unauthorized users no longer see the admin sidebar on...

luci pushed to branch master at Tiki Wiki CMS Groupware / Tiki


Commits:
99e7be30 by Moïse Nturubika at 2026-08-24T19:03:00+00:00
[FIX] UAB: Anonymous/unauthorized users no longer see the admin sidebar on permission-denied errors (WYSIWYCA)
---
* [FIX] UAB: Anonymous/unauthorized users no longer see the admin sidebar on permission-denied errors (WYSIWYCA)

See merge request tikiwiki/tiki!10912

- - - - -


4 changed files:

- lib/Theme/ThemeLib.php
- lib/core/Feedback.php
- lib/setup/theme.php
- templates/layouts/social/layout_view.tpl


Changes:

=====================================
lib/Theme/ThemeLib.php
=====================================
@@ -59,9 +59,19 @@ class ThemeLib extends TikiLib
     {
         global $prefs, $smarty;
         $section = Sections::getCurrentSection();
+
+        // lib/setup/theme.php writes the resolved theme back into $prefs['theme'], so snapshot
+        // it once per request instead of re-reading it - otherwise a later section change
+        // would reuse an earlier call's resolved admin theme as its base.
+        static $baseTheme;
+        static $baseThemeOption;
+        if (! isset($baseTheme)) {
+            $baseTheme = $prefs['theme'] ?? '';
+            $baseThemeOption = $prefs['theme_option'] ?? '';
+        }
         //Initialize variables for the actual theme and theme option to be displayed
-        $theme_active = $prefs['theme'] ?? '';
-        $theme_option_active = $prefs['theme_option'] ?? '';
+        $theme_active = $baseTheme;
+        $theme_option_active = $baseThemeOption;
 
         // User theme previously set up in lib/setup/user_prefs.php
 


=====================================
lib/core/Feedback.php
=====================================
@@ -99,6 +99,15 @@ class Feedback
             die;
         }
 
+        if (
+            ($httpCode == 401 || $httpCode == 403)
+            && \Tiki\Sections::getCurrentSection() === \Tiki\Sections::SECTION_ADMIN_LAYOUT
+        ) {
+            // Don't leak admin UI (UAB layout, admin theme) to unauthorized visitors (WYSIWYCA).
+            // SECTION_ADMIN still counts as "admin" for theme purposes, so go further.
+            \Tiki\Sections::setCurrentSection(\Tiki\Sections::SECTION_GLOBAL);
+        }
+
         $errorPage = $errorPage ?? "error.tpl";
         $smarty = TikiLib::lib('smarty');
         $smarty->assign('errortype', $httpCode);


=====================================
lib/setup/theme.php
=====================================
@@ -125,6 +125,7 @@ Sections::onSectionChange(function ($section) {
     }
 
     //6) include UAB admin CSS and layout in case we are on an admin or management page
+    static $forcedAdminLayout = false;
     if (Sections::getCurrentSection() === Sections::SECTION_ADMIN_LAYOUT) {
         $addSectionThemeCssFile('themes/base_files/css/feature/adminui.css');
         if (! str_contains($_SERVER['PHP_SELF'], 'tiki-admin_modules.php')) {
@@ -132,6 +133,7 @@ Sections::onSectionChange(function ($section) {
         }
         /* Force the admin layout on admin pages */
         $prefs['site_layout_admin'] = 'admin';
+        $forcedAdminLayout = true;
 
         include_once 'admin/define_admin_icons.php';
         foreach ($admin_icons as & $admin_icon) {
@@ -142,6 +144,11 @@ Sections::onSectionChange(function ($section) {
         $smarty->assign('admin_icons', $admin_icons);
     } else {
         $smarty->assign('navbar_color_variant', $prefs['theme_navbar_color_variant']);
+        if ($forcedAdminLayout) {
+            // Undo the forcing above; leave a genuinely configured site_layout_admin alone.
+            unset($prefs['site_layout_admin']);
+            $forcedAdminLayout = false;
+        }
     }
 
     //7) include optional custom.css if there. In case of theme option, first include main theme's custom.css, than the option's custom.css


=====================================
templates/layouts/social/layout_view.tpl
=====================================
@@ -13,7 +13,7 @@
     {/if}
     <a class="btn btn-info btn-lg skipnav" href="#col1" role="button">{tr}Skip to main content{/tr}</a>
     {if !isset($smarty.session.fullscreen) || isset($smarty.session.fullscreen) && $smarty.session.fullscreen ne 'y'}
-        {if $prefs.theme_unified_admin_backend neq 'y' or $smarty.server.SCRIPT_NAME|strpos:'tiki-admin.php' === false}
+        {if $prefs.theme_unified_admin_backend neq 'y' or $prefs.site_layout_admin neq 'admin'}
              <header class="page-header w-100 sticky-top my-0" id="page-header" role=banner>
                 {* Main navigation - uses block for theme customization *}
                 <nav class="{block name=navClasses}navbar navbar-expand-md navbar-{$navbar_color_variant} tiki-top-nav-{$navbar_color_variant} bg-{$navbar_color_variant}-parent tiki-main-navbar{/block}"
@@ -31,7 +31,7 @@
     <div class="middle_outer" id="middle_outer">
         {block name=module_header}{/block}
         {if !isset($smarty.session.fullscreen) && $smarty.session.fullscreen ne 'y'}
-            {if $prefs.theme_unified_admin_backend eq 'y' && $smarty.server.SCRIPT_NAME eq $url_path|cat:'tiki-admin.php'}
+            {if $prefs.theme_unified_admin_backend eq 'y' && $prefs.site_layout_admin eq 'admin'}
                 {modulelist zone=top class="top_modules uab top navbar-{$navbar_color_variant}-parent bg-{$navbar_color_variant}-parent tiki-top-nav-{$navbar_color_variant} w-100 mb-sm" heading_text='{tr}Site identity, navigation, etc.{/tr}' role=banner}
             {/if}
         {/if}



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/99e7be30615fcc7847465752f62d13f26879f0a2

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/99e7be30615fcc7847465752f62d13f26879f0a2
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs