[6.2] Implement secure article preview without requiring frontend login

[joomdonation]

Pull Request resolves # .

• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

This is alternative to #47569. The purpose is allow secure preview (unpublished/un-accessible) articles without requiring login from frontend of the site using an account with certain permissions.

Testing Instructions

• Uses Joomla 6.2
• Make sure you are not logged in in frontend of your site.
• Login to backend of your site, edit an article
• Try to use Preview button to see preview the article. Make sure you can preview the article, even if the article is unpublished or have Access set to certain access level different with Public.

Actual result BEFORE applying this Pull Request

Preview article requires user to login in frontend of the site and have certain permissions.

Expected result AFTER applying this Pull Request

Preview article does not require user to login from frontend. Secure mechanism is implemented using a secure, time-based token to make sure users can only preview article by accessing to the link generated by Preview button in the backend. And the preview link will be expired after the time configured in Preview Token Expiration (hours) parameter in com_content Options.

Additional Information

The code for creating and validating preview token in administrator/components/com_content/src/Helper/PreviewTokenHelper.php is not coded by hand. The JSON data structure, the validation, encode, decode... implements in the class comes from discussion with AI, and by looking at sample code from a JWT library. I have read and verify the accurate of the code, but if the implementation is accepted, I will ask for help from David Jardin for additional security review.

Link to documentations

Please select:

• Documentation link for guide.joomla.org:

• No documentation changes for guide.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed

[brianteeman]

I would prefer to see the preview measured in minutes and not hours. Maybe 15 minutes as a default and then steps of 5.

It all depends if the intent of this feature is to give the content creator a working preview or if this is something you want to share. For me it's the former so there is no need for a long preview time. Even 5 minutes would be enough

[joomdonation]

I can change that. But I think minutes might be a bit low. It is OK for the author to preview but if you want to share the preview URL to someone else not near you, hours would be better.

[joomdonation]

And the URL is protected by a secure token, so having it valid for longer (for example, one hour) would not cause any issue. But Yes, the token expiration time is something I would like to have feedback from you others.

[brianteeman]

If the feature is intended for the URL to be shared then I would add some sharing functionality (that's what @roland-d did iirc) but for me I've always seen this as for the content authors use primarily and even 15 minutes would be 14 m8nutes longer than required

[joomdonation]

OK, thanks. I changed token expiration times to minutes with default value and step as suggested.

[brianteeman]

Thanks 👍

[QuyTon]

I have tested this item ✅ successfully on f10e870

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48030.}

[CSGoat0]

I have tested this item ✅ successfully on f10e870

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48030.}

[QuyTon]

RTC

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48030.}

[brianteeman]

I have tested this item ✅ successfully on 9b7ed8a

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48030.}

[brianteeman]

@MacJoom this would be a really big feautre for 6.2