Page access restriction isn't working

Using Ghost
1

I have a page whose access is set to “members-only” in the Ghost admin. However, the page is still fully accessible to the public.

I suspect it has something to do with my routes.yaml file… I have something like this:

/resource-1/:
  template: custom-directory-with-main-topic
  data: page.resource-1-page

By setting it up this way, I can display a postcard acting as a “link” to a particular page. It works exactly as I intended – I’m able to control the postcard by editing the post, and I’m able to control content “behind” the postcard by editing the corresponding page.

The only thing that doesn’t work is access control.

  • tried setting the post at /resource-1/ to members-only
  • tried setting the page at /resource-1-page/ to members-only
  • tried setting both to members-only at the same time

In all cases, everything is accessible to the public.

Is this possibly a theme issue? Does anyone have an idea of how I could resolve it without overhauling my site’s structure?

2

I’m a little confused by what you’re doing. Is that a route or a collection? What does the code of the template look like?

3

Hi Cathy, it’s a route. To clarify what I’m doing:

I created a post and gave it the URL site.com/resource-1/. My theme renders a postcard for that post.
However, when a user clicks on the postcard, I want them to see data from Page X (instead of data from the actual post).
My solution was to then:

  1. Define a route for the URL where the post lives (/resource-1/)
  2. Create Page X and give it the URL site.com/X-page
  3. Set the route’s data attribute to page.X-page

It’s weird but it works, minus the access controls :sweat_smile:

Here’s the code for the template (from the Rinne theme).

{{!< default}}

{{!-- Page Hero --}}
{{#post}}
  {{> post-hero 
    image_style="hidden"
  }}
{{/post}}

{{!-- Everything in a container --}}
<div class="container wrapper">
  <section class="section section-resources" id="resources">
    <div class="resources" data-filter-position="{{@custom.resources_filter_position}}" data-category="all"
      data-filter-count="{{post.tags.length}}">
      {{#match @custom.resources_filter_position "!=" "hidden"}}

        <nav class="resources-nav">
          <ul class="resources-filter">
            <li class="resources-filter-all">
              <button class="resource-btn all">
                <span class="resource-btn-name">{{t "All types"}}</span>
                <span data-count=""></span>
              </button>
            </li>
            {{#foreach post.tags from="2"}}
              <li style="--color-accent:{{#if accent_color}}{{accent_color}}{{else}}var(--color-brand){{/if}}">
                <a href="#{{slug}}" class="resource-btn {{slug}}" data-category="{{slug}}">
                  {{#if feature_image}}
                    {{> image
                      picture_class="flex"
                      image_type="tag"
                      image_class="lazyload resource-btn__img"
                      image_url=feature_image
                      size_xxs=true
                      size_xs=true
                    }}
                  {{/if}}
                  <span class="resource-btn-name">{{name}}</span>
                  <span data-count></span>
                </a>
              </li>
            {{/foreach}}
          </ul>
        </nav>
      {{/match}}

      <div class="resources-feed js-resources-feed m-b-xl" data-feed-layout="{{@custom.resources_feed_layout}}" data-not-found="{{t "No tackle found — check back later!"}}">
        {{#get "posts" include="tags,authors,tiers" filter="tag:[{{post.primary_tag.slug}}]+tags:[{{post.tags}}]" limit="all"}}
          {{#foreach posts}}
            {{> resource-card}}
          {{/foreach}}
        {{/get}}
      </div>
    </div>

    {{#page}}
      {{#if html}}
        <article class="{{post_class}} content post-access-{{visibility}}">
          {{content}}
        </article>
      {{/if}}
    {{/page}}

    {{!-- Pagination --}}
    {{!-- {{> pagination type="load-more"}} --}}
  </section>
</div>
4

So I suspect that what you’re doing is not intended. (Hey, I’ve been guilty of that, too!) You’ve effectively got the /resource-1 route defined twice, once in the routes section, and once because the post is part of a collection. If it works, great, but I wouldn’t necessarily expect any guarantees that it continues to work - if the Ghost team tweaks how routes are determined in a way that breaks this.

It also sounds like you have found a bug in how access is determined.

So… let’s back up a little bit and think about how to accomplish what you’re trying to accomplish.

Question: Does the post (whose card you want on the front page) actually ever get shown? Or you’re just using it to get a card?

Idea #1: Scrap this idea. Put the content you want the card to link to into the actual post. No routes.yaml trickery. Control access by setting it on the post. [If you wanted the feature that you can turn off the title and header, just make a new template that doesn’t show title and featured image. It’ll be easier than what you’re doing here, I suspect!] Bonus: The former page will be searchable with Ghost’s built-in search, since it’ll be a post.

Idea #2: Put the page’s card onto the landing page. Remove the post, but add a #get request to get the page’s data, and show it. (Use the existing resource-card partial)

Does either of those make sense, for what you’re trying to do?

5

So I suspect that what you’re doing is not intended.

Ah, just as I feared :sob: The reason I did it this way is well, it was the only way I could figure out which accomplished my goal :confused:

Idea #1: Scrap this idea. Put the content you want the card to link to into the actual post. No routes.yaml trickery. Control access by setting it on the post. [If you wanted the feature that you can turn off the title and header, just make a new template that doesn’t show title and featured image. It’ll be easier than what you’re doing here, I suspect!] Bonus: The former page will be searchable with Ghost’s built-in search, since it’ll be a post.
[/quote]

I originally tried this, but it only works to a very limited degree…

The issue is that only some of my postcards are supposed to link to actual post content. Many of them link to a collection of postcards (displayed using a specific template). Then, when you click on one of the postcards in that collection, you’re taken to a webpage that displays… you guessed it - more postcards! Only once you navigate through 3 different “levels” of postcards do you arrive at the bottom level, where the cards link to actual post content. Idea #1 works at the bottom level, but not at any of the levels above it.

Could I send you a message with a link to my website so you can see how it’s supposed to look and behave?

Idea #2: Put the page’s card onto the landing page. Remove the post, but add a #get request to get the page’s data, and show it. (Use the existing resource-card partial)

If I understand what you’re saying, this sounds like my ideal solution. Unfortunately, I didn’t have the skillset to execute it, so I resorted to abusing dynamic routing instead. :sweat_smile: