-
Notifications
You must be signed in to change notification settings - Fork 63
Description
It's difficult to identify what is causing the request to not render; all the messages are provided using the same string.
This was how we designed the error message; it's best security practice to not divulge additional information to potential attackers. The issue is that we aren't showing more helpful messages.
Problem
The current implementation returns the same error message "You are not allowed to view this content." for 11 different access control failures. This creates significant UX and support burden.
All of these different scenarios show the same message:
- View set to "Embed Only"
- Direct access disabled via filt
- View status is Private/Draft
- REST API access disabled
- CSV export disabled
- No Gravity Forms form attached
- Entry not found
- Entry belongs to different form
- Entry not active
- Entry not approved
- Custom entry slug mismatch
Suggested solution
Show more helpful error messages to people who we know have access: administrators, people who have ability to access all Gravity Forms data, etc.
Expected outcome
This will reduce support requests for "You are not allowed to view this content." by more than 50%.