- Issue created by @jessebaker
- ๐ฌ๐งUnited Kingdom jessebaker
๐ Recover from server-side errors that may happen during rendering preview Active does a good chunk of work towards this
- ๐ง๐ชBelgium wim leers Ghent ๐ง๐ช๐ช๐บ
What about errors in (more complex) code components? Is that intended to be handled here, too? (Previously identified this in #3485878-15: Component previews should NEVER be able to render errors, should fall back to a meaningful error instead โ , but perhaps this issue is a better place to discuss it.)
- Assigned to balintbrews
- ๐ง๐ชBelgium wim leers Ghent ๐ง๐ช๐ช๐บ
โจ Creating a page generates the URL path dynamically when editing. Active landed, which is how this actually was pretty easy to trigger until recently ๐
I know @balintbrews is working to add hardening in multiple places, and some have already landed. @balintbrews, do you think that this issue can be marked as a duplicate of some other? ๐ค
- ๐บ๐ธUnited States effulgentsia
It's possible this is already at a state that's good enough for beta, but in case it isn't I'm tagging this as a beta blocker to make sure we evaluate it before releasing a beta.
- ๐ง๐ชBelgium wim leers Ghent ๐ง๐ช๐ช๐บ
I do not currently know of any remaining way to get to such a state. @mayur-sose, do you know of one?
@wim-leers, below is the one :
- Create a new code component.
- Add the component to the library and place it on the canvas.
- Go to Layers, click on the three dots, and select Edit code.
- After that, try to delete the component from Layers.
-
You will see the following error:
An unexpected error has occurred in a route. 404 Not Found
- ๐ง๐ชBelgium wim leers Ghent ๐ง๐ช๐ช๐บ
Ah, that's the detail that was missing! We've already got an explicit bug report for that: ๐ ContentCreatorVisibleXbConfigEntityAccessControlHandler bypasses admin permissions for view Active .
Thanks, much appreciated!
- ๐ง๐ชBelgium wim leers Ghent ๐ง๐ช๐ช๐บ
@mayur-sose You wrote "below is the one" โ does that mean it's the only way you were able to get trapped? ๐ค
Iโm investigating whether there are any other situations where users can get trapped. I will update you if I find any.
- ๐ง๐ชBelgium wim leers Ghent ๐ง๐ช๐ช๐บ
Great, thanks! ๐ I hope you'll fail, for all our sakes ๐๐
- ๐ช๐ธSpain penyaskito Seville ๐, Spain ๐ช๐ธ, UTC+2 ๐ช๐บ
I can reproduce #8 and has nothing to do with the other issue mentioned in #9.
See my amend to #8:
- Create a new code component.
- Add the component to the library and place it on the canvas.
- Go to Layers, click on the three dots, and select Edit code.
- After that, try to delete ANY component from Layers.
You will see the following error:
An unexpected error has occurred in a route. 404 Not Found
This happens even if I'm deleting something that is not what I'm seeing in the editor.
But surprisingly only happens if I have that component in the editor.The difference is that if I create a new editor, my url is:
xb_page/1/code-editor/code/test
.
But if I edit a placed component code, my url is:xb_page/1/code-editor/component/jjj
(see component instead of code).
When I delete a component, even if it's not the one selected, i go from
xb/xb_page/1/editor/component/0b914052-f057-4a94-81db-bb64a09850e3
toxb/xb_page/1/editor
(removing thecomponent/{uuid}
).I think we are trying to do the same here, but ending in
xb_page/1/code-editor
which is a wrong url (you can just go directly in the browser and will see the same error Majur indicated)Maybe there's something checking a regex
component/{whatever}
without checking a) that whatever is a uuid or, b) that we are at/editor/component/{whatever}
(ensuring no match with/code-editor/component/{whatever}
- ๐ช๐ธSpain penyaskito Seville ๐, Spain ๐ช๐ธ, UTC+2 ๐ช๐บ
Per #13, unpostponing.
- ๐ง๐ชBelgium wim leers Ghent ๐ง๐ช๐ช๐บ
Related but more obscure way to get trapped: ๐ After source session timeout, XB page stuck on the error message Active .
- ๐ซ๐ฎFinland lauriii Finland
We've made improvements to the error handling to avoid this from happening in more cases. Discussed with some of the XB folks that we will be opening issues for specific instances where this happens in case that we run into those in future.