Upgrade to EE 2.7.3 login to CP via link not working any longer

Question

On 2.5.5 I had a link like this on the client's product pages: http://cl.ly/image/2c3G3m1X0a3D

Very simple, if they are logged into the CP on another tab, they click the edit link and it opens this product's CP edit page in a new tab. The link looks like this: http://www.domain.com/admin/index.php?D=cp&C=content_publish&M=entry_form&channel_id=12&entry_id=7832

Worked great for years. Note also that the link is only shown if all these are true, so we know they are logged into a current CP session and have the right to see the link:

    $is_admin = TRUE;

    if($this->EE->session->userdata('group_id') != '1' AND $this->EE->session->userdata('group_id') != '6') {
        $is_admin = FALSE;
    }

    if($this->EE->session->userdata('access_cp') != 'y') {
        $is_admin = FALSE;
    }

    if($this->EE->session->userdata('admin_sess') != 1) {
        $is_admin = FALSE;
    }

I updated them to 2.7.3 and now those same links bring up just the CP login page. What has changed in the session/security model that would prevent this from working?

Answer 1

I believe what changed is that EE now defaults to requiring session IDs in the control panel URLs. (That's the S=e8a181fc77af1b35e47193c0e0b27a15 part you see.)

You can disable this at Admin -> Security and Privacy -> Security and Sessions, changing the Control Panel session type to Cookies Only.

Or, you can just add the session ID into your URLs, which is available in templates as {cp_session_id}