Attempting to access non-lowercase /cas path when logged in results in Access Denied

Created on 1 December 2015, over 9 years ago
Updated 1 May 2024, about 1 year ago

The cas_menu_site_status_alter function in the cas.module file redirects logged in users that visit the /cas path to the front page. However, if logged in users visit any variation of that path without all lowercase letters, such as /Cas or /CAS, users are instead giving the "Access Denied" error message.

Since the cas_menu_site_status_alter function compares $path to 'cas', any non-lowercase path will fail the comparison and not redirect the user, who then receives the error due to the user_is_anonymous access callback on the /cas menu item.

My proposed solution is to compare the lowercase version of $path by using the PHP function strtolower.

🐛 Bug report
Status

Fixed

Version

1.0

Component

CAS

Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

No activities found.

Production build 0.71.5 2024