[Users & Roles] | Invite new user - Email link redirect new user, with Site Access options setting for users who must be registered enabled user cannot be registered

[Tribunal33]

Valid Title

• I have updated the title to accurately reflect the bug description

Description

From forum post: https://forum.pkp.sfu.ca/t/problem-inviting-new-user-unless-journal-is-public-ojs-3-5-0-3/97812
With a site setting enabled the new invite user workflow doesn't work. The email invitation will instead go to a login page and can't access the invited user registration workflow.

Steps to Reproduce

1. Precondition: must have setting enabled for Users & Roles > Site Access Options > Site Access > Users must be registered and log in to view the journal site.
2. Login with JM/Admin role
3. Invite a user - Users & Roles > Invite to a role and complete this process for a new user
4. Either logout of current user or use Incognito mode when accepting the invite.
5. Go to email client and find invite.
6. Accept the Invite (incognito mode)

Expected Result

Should be redirected to a invitation process

Actual Result

Are redirected back to login page.

Environment Details

No response

Application Version

OJS 3.5.0-3 and main

Logs

No response

Additional Information

No response

Pull Requests
pkp-lib: #12433
ojs(submodule update): pkp/ojs#5403
omp(submodule update): pkp/omp#2258
ops(submodule update): pkp/ops#1223

[asmecher]

I think, at a glance, it should be possible to resolve this by adding invitation to the list of exemptions in lib/pkp/classes/security/authorization/RestrictedSiteAccessPolicy.php. However, this needs testing.

[taslangraham]

Did a quick test and the issue of the user getting redirected to login screen is solved by adding invitation to the list of exemptions in lib/pkp/classes/security/authorization/RestrictedSiteAccessPolicy.php. However, once the relevant screen is loaded, API calls to 'invitations' endpoints fail due to the Users & Roles > Site Access Options > Site Access > Users must be registered and log in to view the journal site setting being enabled. So the unregistered user is still blocked from continuing the invitation process.

API Error Message: You have been denied access. Access to this site is currently restricted.

I'll continue to look in this.

[taslangraham]

@asmecher could you give a review to the small PRs listed here #12374 (comment)? Thanks in advance.