I've configured a route to a custom controller that returns a json feed on the homepage of a site:
URL: mysite.com/api/event?...
routes.yml:
Director:
rules:
...
'api': 'API_Controller'API_Controller.php:
class API_Controller extends Page_Controller
{
//allow only specific actions to be executed by the $request
private static $allowed_actions = array('event');
/**
* @return SS_HTTPResponse_Exception a 404 page if accessing controller index
**/
public function index()
{
return $this->httpError('404', 'Page not found');
}
/**
* @param current request
* @return json page response
**/
public function event($request)
{
return $this->processEvent($request);
}
...This works correctly until I login to the admin part of the site. Then if I try and request the json feed through the route the cms complains that I don't have permission to view the draft version and that I should 'click here' to view the live version. The link it creates for the live version is a url to the controller (ignoring the routing configuration), but obviously none of that is very useful in an ajax response that is expecting json.
Since there is no draft version of this page - well it isn't even a page - I'm wondering where the request is being intercepted and the security applied... any pointers appreciated.
