Enable logged-in users to access polls by personal url recieved by mail
Maintainers usually reply within 2 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- javascript
- Domain
- authorization
Research direction
Start by tracing how personalized poll invitation URLs are handled for logged-in users and where poll access rights are checked. Verify that a logged-in recipient with the invitation URL can open the poll, while existing access behavior remains unchanged; the issue does not name specific files or tests.
Written by the indexing model from the issue text.
Description
⚠️ This issue respects the following points: ⚠️
- I agree to follow Nextcloud's Code of Conduct.
Describe the goal you'd like to achieve
As a poll participant that is already logged-in to Nextcloud, I want to be able to access polls by direct url received by mail. At the moment, if a poll owner sends an invite to multiple people using a list of mail addresses the single person receives a mail with a personalized url in it. If a already logged-in user clicks on this link the user sees a error message that the poll can't be accessed.
The problem resides in the fact that polls seams to check if the already logged-in user has access rights to the specific poll. If the user hasn't polls refuses to open the link even tough the user is in possession of the "secret" needed to access the poll (= the url).
This previously was reported as bug in #4975
Describe possible solutions
In my opinion a user that is logged in should always be able to open these types personal links (if the user is in possession of this "secret" this should be enough to grant him access to the poll).
Additional context
At the first thought this seams like additional security, but it isn't: if the user simply opens a private tab the url of the poll can be accessed. Therefore IMHO it makes no sense to show an error message to the user when already logged-in.
This specially is a problem to enterprise users that need to create polls to many people and therefore use the option to send the invitation links to many addresses.
- Dominant language
- JavaScript
- Stars
- 285
- Forks
- 91
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 52
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from nextcloud/polls
-
new
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
nextcloud/polls#4874 · 1 comment ·
Maintainers usually reply within 2 days
-
new
Difficulty 3/5 1-2 days Newbie friendliness 52/100
nextcloud/polls#4875 · 2 comments ·
Maintainers usually reply within 2 days
-
UX
Difficulty 3/5 1-2 days Newbie friendliness 48/100
Maintainers usually reply within 2 days
-
UX
Difficulty 4/5 3-5 days Newbie friendliness 45/100
Maintainers usually reply within 2 days
-
UX
Difficulty 4/5 3-5 days Newbie friendliness 45/100
Maintainers usually reply within 2 days
Similar issues
-
docs hacktoberfest help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
pacocartones/free-llm-api-hub#347 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
cytoscape/cytoscape.js#3536 ·
Maintainers usually reply within 15 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
cuttle-cards/cuttle#1440 ·
Maintainers usually reply within 1 day
-
URL-encoded parser builds nested objects nothing readsPossibly taken @Senthil455 claimed this today. Open
Difficulty 1/5 Under an hour Newbie friendliness 82/100
Janani-bn/CivicFix#168 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
code-yeongyu/oh-my-openagent#10172 ·
Maintainers usually reply within 1 day