Enable logged-in users to access polls by personal url recieved by mail
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 284
- Forks
- 91
- Avg merge
- 4d 3h
- Merged PRs (30d)
- 50
Description
⚠️ This issue respects the following points: ⚠️
- I agree to follow Nextcloud's Code of Conduct.
Describe the goal you'd like to achieve
As a poll participant that is already logged-in to Nextcloud, I want to be able to access polls by direct url received by mail. At the moment, if a poll owner sends an invite to multiple people using a list of mail addresses the single person receives a mail with a personalized url in it. If a already logged-in user clicks on this link the user sees a error message that the poll can't be accessed.
The problem resides in the fact that polls seams to check if the already logged-in user has access rights to the specific poll. If the user hasn't polls refuses to open the link even tough the user is in possession of the "secret" needed to access the poll (= the url).
This previously was reported as bug in #4975
Describe possible solutions
In my opinion a user that is logged in should always be able to open these types personal links (if the user is in possession of this "secret" this should be enough to grant him access to the poll).
Additional context
At the first thought this seams like additional security, but it isn't: if the user simply opens a private tab the url of the poll can be accessed. Therefore IMHO it makes no sense to show an error message to the user when already logged-in.
This specially is a problem to enterprise users that need to create polls to many people and therefore use the option to send the invitation links to many addresses.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how personalized poll invitation URLs are handled for logged-in users and where poll access rights are checked. Verify that a logged-in recipient with the invitation URL can open the poll, while existing access behavior remains unchanged; the issue does not name specific files or tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100