Pimcore: [proposal] shared includes snippets should not be publicly viewable as documents/web pages (potential security risk?)

[ceefour]

Bug Report

Expected behavior

Some documents, such as /en/shared/includes/footer, teasers, etc. are meant to be included by other "real" documents, but not viewable by itself.

e.g. https://demo-basic.pimcore.org/en/shared/includes/footer is only for internal use.

Actual behavior

https://demo-basic.pimcore.org/en/shared/includes/footer is visible.

Steps to reproduce

Visit https://demo-basic.pimcore.org/en/shared/includes/footer

[brusch]

Snippets are by design public available, that's not a bug, but we can discuss whether this makes sense or not, but in any way it would be a BC break.

[ceefour]

@brusch ok. I'd suggest on Pimcore 7 snippets should be private, unless there's a common use case it should be public?

Having them public could potentially be security risk. Documents can be secured with authentication, but maybe admins don't realize that snippets (with non public contents) need to be secured individually as well.

[dpfaffenbauer]

I agree with @ceefour here. Guess the document router should just not pick up on Snippets outside the admin context. Wouldn’t even be a BC IMO since they shouldn’t be used publicly anyway