Detailled 404 for category page

feature
#1

Even with detailed 404 setting enabled, following a category page (site.com/c/category or site.com/c/category/subcategory) does not link for a custom 404 page, the same way clicking on a post page (site.com/t/title/1234) does. Or am I missing something ?

Is this the intended behaviour ?

IMHO, the custom page for the category/subcategory is even more important than for the post (there is less risk to acknowledge the existence of the category than the post, plus the custom page would link directly to the group in question). So i would suggest to add the custom page for these links as well.

3 Likes
#2

I would also welcome this. The information disclosure risks can be much more manageable if it is only applied to categories.

Otherwise, by enabling that setting it also allows for discovering private messages for example.

1 Like
#3

Possibly – @eviltrout can you have someone estimate effort on this one? I’m sympathetic because categories are closely tied to permissions in Discourse, so it makes sense that the 404 would reveal a bit more in this case.

2 Likes
#4

I’m sure it’s a small amount of effort. @riking can you handle it?

4 Likes
#6

Any updates on this?

#7

@riking bumping the thread

#8

It appears that this was broken at the same time as Error page appears repeatedly after you try accessing a private page.

I believe I have a clean fix by placing the logic into the exception controller, which will allow future additions to detailed_404 to happen much smoother, if we ever decide to do so.

3 Likes