restrict access to members save as IE .mht

[rafael]

I´ve got a restrict member page with dfgallery.

If someone wants to see it, must login.

Everything was ok, but if I save this page as .mht with Internet explorer, I can reach the page whitout login.

How can avoid it?

[Vera]

I tried this on a few websites I made and it does not work as you describe. The problem does not appear to exist in my copies of TL/Contao. So a few questions just to make the problem more clear to me (and others). ops:

1. Is that particular page actually restricted, or just another page that links to this one?[/*:m:c2aueavs]
2. After saving, did you logout?[/*:m:c2aueavs]

Furthermore, people able to save also did login, so unless they start spreading the mht there is no problem. And TL/Contao takes no effort to protect files in the filesystem, so anything in the gallery is probably accessible without passwords anyway.

[rafael]

Hi,
Contao 2.9.1

It is a dfgallery restrcted in a page restricted. So if a user wants to see the gallery need to login (member group).

But if this member login and save the page where the dfgallery is, as .mht in IE and after that logout, and double clic icon c://whatever-file-name.mht get the gallery without have to log.

So he doesn´t need to login again, he can access to jpgs because .mht link to them (in server).

It surprises me because, how is possible to access to a module and page protected only for saving as .mht?

Best regards

[ramjet]

Because once they've logged in the browser is allowed to read the files ... so the browser has all the read files in its cache.
These files are saved (that is: if you changed the images, the mht file wouldn't read the new ones)

[rafael]

Images are not in the cache because we block that... images are showed from the server as you said...

But the point is:

how is possible if i write on the explorer www.abcbla.com/forinsteadgallery.html cause is a protected page answer: FORBBIDEN,

but if the .mht ask for the same page www.abcbla.com/forinsteadgallery.html
DON´T NEED TO LOGIN AS A MEMBER.

why is not working the restricted access?

[ramjet]

Images are not in the cache because we block that

You block the browser cache? how do you do that?

If you are not connected to the internet at all and you click your .mht link, what happens?

[rafael]

block the cache with .htaccess
Header set Cache-Control "max-age=0, private, no-store, no-cache, must-revalidate"

if you are not connected, can´t see the images because .mht ask for the server.

so, if there is not a way to avoid this, member restricted access has a big problem if you want for instead to permit access during one week.

if the user save the page as .mht, don´t mind if webmaster close the member access, because user can see in his c://whatever.mht while page and images were the same.