Protected/Development/Maintenance Mode

[adrian]

This is a simple module to prevent guest users and search engines from accessing to your site. Primarily it is designed for use during site development.

Modules directory: http://modules.processwire.com/modules/protected-mode/

Github: https://github.com/adrianbj/ProtectedMode

1. Install and check the "Protected Mode" checkbox
2. Create a user with only the guest role and give the login details to your clients/testers. Of course existing admin users can use their personal logins still.

There are some similarities with Pete's excellent Maintenance Mode module, but the reason I built this, rather than using Maintenance Mode is:

• I didn't want the "Maintenance Mode" badge showing up on the site since this is for development before a site has ever been live and I didn't want the client seeing that badge.
   
• I didn't want users redirected to the PW login page because I didn't want visitors to see the PW login page. I know the module has the option to redirect to a custom page, which you could use to make a front-end login form, but that seemed more complex than I needed (and I think other PW devs might also need).
   
• Because of the way this module replaces Page::render with the login form, visitors can be sent to any page on the site, and once they login that page will reload with its full content - no messing around finding the page again, and no need for sending page ids through the login process to redirect back.
   
• This module also lets you configure the message that is displayed along with the login form, and also apply some css to style the login form.

 

Hope you guys find it useful.

[adrian]

Just a small update that adds some nice default styling to the login form. It populates the CSS field on install so you can still edit however you want, but gives a much nicer starting point

If you have the module already installed, you'll want to update, then uninstall and reinstall to populate the CSS field.

It now looks like this by default:

[adrian]

Hi everyone,

I'd like to announce a complete overhaul of this module - problem is that I am not sure whether to release it as an update to this module, or perhaps as something completely new, perhaps called PageProtector.

UPDATE: The functionality described in this post is available as a separate module: PageProtector

This new version (not on github just yet) makes it very easy for site editors to set up various password protected areas on their site, or to simply protect a new page or section while they are still working on it.

 

New functionality

• Ability for your site editors to control the user access to pages directly from Settings tab of each page
• Includes whether to protect all children of this page or not
• Optionally allows access to only specified roles
• Ability to change the message on the login page to make it specific to this page
• Option to have login form and prohibited message injected into a custom template
• Access to the above "Protect this Page" settings panel is controlled by the "page-edit-protected" permission
• Table in the module config settings that lists the details all of the protected pages
• Shortcut to protect entire site with one click

What do you all think - replace the existing module, or release this functionality as a separate version?

 

Module Config Settings

 

Page Protection Settings

[adrian]

Please fill out the poll at the top of the page to help me decide on how to release this new functionality.

Thanks!

[onjegolders]

This looks great Adrian, not sure about which option to check as haven't used the first module. This could definitely be a module in it's own right though. Could be really useful.

[ceberlin]

Hi Adrian,

great idea. I will try this out on my new project.

Just curious:

Isn't there a need to also sanitize the password somehow (or is PW handling that?)

Like a max-length, trim whitespaces (for user convenience)

[adrian]

ceberlin,

Just so you know, the new enhanced version (with page specific, editor managed control) is not released just yet - I am on vacation for the next two weeks, but I plan on releasing when I am back.

The login process is still handled by PW, so need to do any additional sanitizing/cleaning.

[ceberlin]

sounds exciting!

[lsag]

this will come very handy

[adrian]

Hi everyone,

Finally made some time to get the new module live. It is called Page Protector and you can find out more about it here:

https://processwire.com/talk/topic/8387-page-protector/

Thanks to everyone who voted in the poll - based on the results, there will be two separate modules maintained: ProtectedMode and PageProtector.

PageProtector can do everything that ProtectedMode can, so if you have a need for the features of PageProtector on a site, then there is no need to use ProtectedMode during development.

[houseofdeadleg]

Just been having a look at this as it seems to be something I'm after along the lines of this thread. One question though – currently if the page is protected all you see is the message/login boxes, no header, navigation, etc. Is it possible for the message/login boxes, etc to appear within the body section of an existing template? As in, it goes to a normal page but all the content is hidden and all that's there is the login boxes?

[adrian]

Just been having a look at this as it seems to be something I'm after along the lines of this thread. One question though – currently if the page is protected all you see is the message/login boxes, no header, navigation, etc. Is it possible for the message/login boxes, etc to appear within the body section of an existing template? As in, it goes to a normal page but all the content is hidden and all that's there is the login boxes?

This module has intentionally been kept very simple, hence the login box appears on it's own. I actually prefer this for sites in development so that users can't see anything about the site until the protection has been disabled.

However, what you are looking for is available in the Page Protector module. Just use the Login Template option in the module config settings. If you have any questions about it, please continue this discussion over in that thread.

[pwired]

Hi,

I have a site online using the protected mode module which was working very well.

Only now that I have added a second page the proteced mode is having problems.

When I login in protected mode the home page shows up like usual.

I can navigate to the second page but when I then want to return to the home page,

I have to relogin. I login again and then the same situation happens again.

Is this normal behaviour ? I checked if I have overlooked any special settings in the

configuration of the module but haven't seen anything.

Edit:

On a local server everything works fine. Haven't figured out yet how this problem is related with the online host.

Edited December 7, 2015 by pwired
PWired, merged your thread here. This is the module's support forum :-)

[adrian]

Hi,

I have a site online using the protected mode module which was working very well.

Only now that I have added a second page the proteced mode is having problems.

When I login in protected mode the home page shows up like usual.

I can navigate to the second page but when I then want to return to the home page,

I have to relogin. I login again and then the same situation happens again.

Is this normal behaviour ? I checked if I have overlooked any special settings in the

configuration of the module but haven't seen anything.

Edit:

On a local server everything works fine. Haven't figured out yet how this problem is related with the online host.

I haven't come across this - I wonder if it's the fingerprint config setting - try setting that to false and see how it goes.

[pwired]

Ok found it

I forgot to retain the User Authentication Salt when I moved the site

from local server to online server.

All good now.

[pwired]

Hi

I am using the ProtectedMode module version 0.0.9 but when a client logs in he can only see the homepage. The site has a top navigation bar for many pages but to see other pages the client has to each time relogin through the ProtectedMode login window. I added him to the list of users with a guest role. The same happens when I login as a superuser. I didn't see any settings in the ProtectedMode module to let a client only see the home page or all pages, also I don't see the two parts:

a) Protected Pages and b) Protect Entire Site like here in these settings:

https://processwire.com/talk/topic/7723-protecteddevelopment-mode/#entry78233

Disabling session challenge and fingerprinting does not make a difference.

Any idea ?

[pwired]

Ok I understand I have to use the ProtectedPage module in order to see those configurations. I still wonder though why with the ProtectedMode module only the homepage is viewable. Maybe something on the host.

[adrian]

Ok I understand I have to use the ProtectedPage module in order to see those configurations. I still wonder though why with the ProtectedMode module only the homepage is viewable. Maybe something on the host.

Are you sure you only have Protected Mode installed? I wouldn't be surprised if there were some issues if you have both modules installed.

[Christophe]

Hello Adrian,

I hope you are doing well!

Does "Protected Mode", or "Page Protector", have the ability to put an entire website in "maintenance mode" for an undetermined time (eventually with a customizable message), but without affecting SEO?
With a 503 status code and perhaps in combination with a particular HTTP header (Retry-After).

A nonprofit association committee has just asked me to put its website in maintenance mode (like have done other committees) because their federation has a legal problem, surely with a committee that leaved it some time ago.

Have a nice day!

[adrian]

Neither of those are designed for maintenance operations. You might be better off with: http://modules.processwire.com/modules/maintenance-mode/ - unfortunately is currently doesn't throw a 503 either, but it should be a very simple change - perhaps you could send a PR to @Pete if you decide to use it and add that? 

[Christophe]

Thank you Adrian for the clarifications/confirmations.

I'm going to ask Pete.

[horst]

@Christophe, once I have hacked a module (in an early version) of adrian to add exactly what you are looking for.

GET  http://fua.pw.nogajski.de/ [HTTP/1.1 503 Service Temporarily Unavailable 187ms]

Date: Thu, 13 Oct 2016 20:14:54 GMT
Retry-After: Sat, 22 Oct 2016 11:22:00 GMT

So, if you like, I can upload it here as is, in a zip. Maybe, @adrian gets inspired and can add this into the current dev of his module as a maintenance feature, additonally to the site protect feature!?

very old, hacked version of protect with maintenance.zip

 

Edited October 13, 2016 by horst
added zip

[adrian]

Hey @horst - I am happy to add that functionality to this module, but I guess I thought it belong more in Pete's module, but if you guys would rather see it here, that's fine with me.

Do you feel like sending me a PR? Otherwise if you post the zip, I can grab the relevant bits and incorporate.

[horst]

updated my post above with the zip. It is an early version that I set to 777, to avoid overwriting with updates of the original module. I also must have one version somewhere in use, where the estimated end date is reflected in the user readable message at the login screen too.

 

[horst]

44 minutes ago, adrian said:

I guess I thought it belong more in Pete's module, but if you guys would rather see it here, that's fine with me.

I think, sending a 503 and "retry after" should be done everytime if the whole site is closed / protected, regardless if you call it protect mode or maintenance mode. This is important for SEO.

I think both of the modules, yours and Petes, should do that by default, when the whole site is not accessible for SearchEngines. (just my 2cents)