17 August 2012, 8:14

I have a faculty member who is using the secret url function to share her tenure portfolio with reviewers.  When we try to use the secret url that's been generated, the url redirects immediately to a url with &login appended to the end (ie, https://portfolios........../.......Cil9 becomes https://portfolios........../.........Cil9&login).  

I've not seen this behavior before.  We recently upgraded from 1.4 to 1.5.  Is there some new security setting I need to tweak?  We really need to disable this redirect to login, so that she can share her portfolio with reviewers.  Thanks.

18 August 2012, 6:48

This rings a bell for me. Is your site still available unsecurely ie. via 'http' without the 's'? Try it that way and see if it works.

20 August 2012, 9:21

Thanks for the suggestion Dirk.  I tried the secret URL as a plain http:// link, but our system is set to require secure access and the plain http:// link was switched by the server to https:// with the &login added.  

If Mahara had a separate login page we could direct users to, I might be able to convince our campus tech folks to just set up secure access for the login page and keep the rest of the site with plain http:// access.  But as it stands, they're not going to want to disable secure access on the site.

We had secure access on previous versions of Mahara, but didn't have the secret URLs require login.  I'll have to see what I can track down about changes in security for 1.5 I guess.  Any other ideas?  Thanks.

20 August 2012, 10:00

Hello Keith,

Does this happen only on the secret URLs or also when you share any other pages and are not logged in, e.g. just regular public access?

I only found the following discussions which point to session issues when the ?login come up unexpectedly.

https://mahara.org/interaction/forum/topic.php?id=1424

https://mahara.org/interaction/forum/topic.php?id=693

https://mahara.org/interaction/forum/topic.php?id=4103

Cheers

Kristina

21 August 2012, 8:05

Thanks Kristina.  I was going to test not logged in access to public pages this morning, when I heard from the faculty member that her secret url was working as it should.  I have no idea what has changed, which is a little unsettling, but we'll just keep an eye out to see if it happens again.  keith

23 August 2012, 15:48

Hello Keith,

Wow. A problem solved itself? Sounds good, but I agree that it would be better to know why it happened in the first place.

Cheers

Kristina