Skip to content

"You are not allowed to view this content." messages are hard to debug #2491

@zackkatz

Description

@zackkatz

It's difficult to identify what is causing the request to not render; all the messages are provided using the same string.

This was how we designed the error message; it's best security practice to not divulge additional information to potential attackers. The issue is that we aren't showing more helpful messages.

Problem

The current implementation returns the same error message "You are not allowed to view this content." for 11 different access control failures. This creates significant UX and support burden.

All of these different scenarios show the same message:

  1. View set to "Embed Only"
  2. Direct access disabled via filt
  3. View status is Private/Draft
  4. REST API access disabled
  5. CSV export disabled
  6. No Gravity Forms form attached
  7. Entry not found
  8. Entry belongs to different form
  9. Entry not active
  10. Entry not approved
  11. Custom entry slug mismatch

Suggested solution

Show more helpful error messages to people who we know have access: administrators, people who have ability to access all Gravity Forms data, etc.

Expected outcome

This will reduce support requests for "You are not allowed to view this content." by more than 50%.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions