Internal (but non-joomla) URL as Menu Item

Question

The Goal

We have a subset of items on our site that are not Joomla pages, but other systems such as a selection of HTML5 and Flash (for now) Games:

• /play
• /photobooth
• etc.

These should only be accessible after logging in through Joomla, but trying to intercept these URLS only leads to Joomla Errors Bypassing Joomla works, but then anyone can access them, and the connections we have don't work.

The Suggested Process

1. Add new Menu Item (System -> URL)
   • So, when going to this Alias, rather than going directly to the subset of the site, it first goes through Joomla for Login.
   • See Below for Image of Configuration
2. Add new Menu Item to Article / custom Menu
3. Click on new Link

4. If Logged in:

   1. Go to page

5. If not Logged In:

   1. Redirect to Login Page
   2. Redirect back to Menu Alias

The Issue (Step 2)

"Internal" links that are not Joomla need to be accessed only when logged in with Joomla

Intended Behavior

1. If Logged in:

   1. Go to page

2. If not Logged In:

   1. Redirect to Login Page
   2. Redirect back to Menu Alias

Actual Behavior

1. If Logged in:

   1. Redirects to "404 - Component not found."
      • (See Below)

2. If not Logged In:

   1. Redirects to Login Page
   2. Redirects to "404 - Component not found."
      • (See Below)

System

• Joomla: 3.8.10
• PHP: 7.1.21
• Database: 5.5.5-10.0.36-MariaDB

Images

404 - Component not Found

Menu Item Configuration

Answer 1

The URLs you mention leads to html documents that are not part of the Joomla Application.
You can not implement Joomla's ACL on pages which are not part of Joomla and are otherwise publicly accessible.

When you link to an external (of the Joomla app) URL like the one you show in the screenshot: /play/cruiseship/lobby if that are url is a valid one, you will get there and your browser will load/display the content that exists there. But this is not Joomla anymore.

The Issue (Step 2)

"Internal" links that are not Joomla need to be accessed only when logged in with Joomla

Simply the above cannot happen. Unless you have coded those pages like this, it seems to be nothing that will tell if it's a user registered in your Joomla site or anything else related to Joomla. Restriction based on Joomla ACL cannot occur, no redirect for non-registered users can happen.

Regarding The 404 errors, I would guess that this is caused by wrong URL path you have given to the system links or something. Not sure how you have managed to make Joomla requesting a login. I guess something among the various settings you have tried. But I would guess, that still if you just try to access those html files directly using their correct path, you would be able to access/load them.

Answer 2

This can be done, with a bit of mucking about with .htaccess and PHP.

Roughly;

For each directory that contains external content, your http server should redirect the URI as a parameter to a PHP file.

That PHP file needs to fire up the necessary bits of Joomla, and then call Joomla to determine whether a user session currently exists.

If not, call mod_user for authorization; that call can include a parameter which is the URL of a Joomla page that is displayed upon a successful login. That page should include the links to the non-Joomla content hosted on your site.

If a user session exists, then simply open the requested file, and return the contents to the httpd daemon.

Note that it turns out that using a menu item that is a URL type no longer plays nicely with the post login redirect option on mod_login, for current versions of Joomla.

Answer 3

I've handled this one fairly simply recently.

Create a custom template with a custom field, the custom field will hold the "external" URL. In your custom template, do your checks whether the user is authenticated or not, and redirect as necessary. Here's a snippet:

$app = JFactory::getApplication();
$message = "You must be logged in to view this content";

if (JFactory::getUser()->guest) {
    $url = JRoute::_('index.php?option=com_users&view=login');
}
else { 
    $url = $var-containing-your-external-url;
}
$app->redirect($url, $message);

Note, because your external URL is not within Joomla's control, you have no method to prevent a non-logged in user navigating directly to the external page in their browser.

Answer 4

You can't use Joomla's authentication system to authenticate access to pages that are not controlled by Joomla.

The reason is in the nature of the web. Every http request is a blank slate; it knows nothing about any previous requests unless it is explicitly told about them. If the pages being accessed have not be written to check for Joomla authentication, then they will never know if the authentication has happened.

To look at it another way, Joomla authentication is not a server-level process; it's an application process. Thus the server never knows whether the authentication happens, it simply passes on the requests it gets to the Joomla application, which checks to see if the request matches someone that has been authenticated by it. Pages that are not written specifically to work with the Joomla application don't know how to look for that info.

Your best bet on this (still not all that good) is to code the .htaccess to permit direct non-Joomla access to those specific directories, then in those directories check the referrer to see if the request has been referred from Joomla (or from itself). But the issues you'll find there are, among others, that browsers are often being set these days to not send referrer info (stops someone tracking where you've been) and the referrer info is trivial to spoof.

Answer 5

Joomlatools Pages allows you to use Joomla's router and ACL and use html, php, and more to layout pretty much whatever you want.

https://www.joomlatools.com/blog/developer/joomlatools-pages-the-page-generator-for-joomla