adrian

Page Protector

Recommended Posts

Just make sure you run Modules > Refresh

Ah, okay, I've missed that. Thanks for the clarification - and sorry for my silly "bad idea" statement...

Share this post


Link to post
Share on other sites

The module (somehow) stopped working.

I installed it and (like always) it worked like a charm. I used the somewhat older version but after restarting my localhost it stopped working. 

I deleted it, installed the newer version, and even tried to use a different login template. Nothing seems to work. Is this a frequent error that's easy to solve? And might it be in conflict with the MVC-ish Approach I am using? (https://processwire.com/talk/topic/4892-an-almost-mvc-approach-to-using-templates/).

I deleted the cache, the sessions and I even set the specific role "superuser" to the page. Yet I can just visit the Home page without having to login.

It might be a real rookie/newbie mistake I'm dealing with, would be sweet if anyone knows how to solve it.

Share this post


Link to post
Share on other sites

@jrtderonde - I have never had a problem with it not working, so you'll need to help debug this. I find it weird that it worked until you restarted. 

Can you post a screenshot of the module config settings page and if you are using the login template approach, could you please post the code from that template. 

Share this post


Link to post
Share on other sites

Thanks for your reply. My settings are here: http://imgur.com/xjfRhvM.

The code I am using for the login template are below:

<?php

    // Variables
    $css = Wire("config")->urls->templates .  "assets/css/styles.css";
    $favicon = Wire("config")->urls->templates . "assets/img/favicons/favicon.ico";

?>
<!DOCTYPE html>
    <head>
        <title>Login</title>
        <meta charset='utf-8' />
        <link rel='stylesheet' href='$css' type='text/css' />
        <link rel='shortcut icon' href='$favicon'>
    </head>
    <body class='login'>
        <div class='full-size'>
            <div class='container'>
                <div class='protected-mode-container'>
                    <div class='top'>
                        <h1>Inloggen</h1>
                    </div>
                    <form class='protectedModeForm' action='./' method='post'>
                            <p>Lorem ipsum dolor sit amet, con sectetuer adipiscing elit. Aenean commodo eupio ligula eget dolor.</p>
                            <input type='text' class='input' name='username' placeholder='Naam' value='' />
                            <input type='password' class='input' name='pass' placeholder='Wachtwoord' value='' />
                            <button type='submit' class='button' name='login'>Login</button>
                    </form>
                </div>
            </div>
        </div>
    </body>
</html>

It's just really weird that even if I destroy all sessions, it won't let me visit this login page.

Hope we can work this out, thanks for your time  O0


Don't mind the non-echoed variables (stylesheets).

Share this post


Link to post
Share on other sites

I can't see if you have anything selected for the login template in your settings - your screenshot is cut off. Is it definitely pointing to the login template php file? If it is, then we need to make sure the module is being loaded - can you add some debug statements to the module - I would start by making sure the "ProtectedCheck" method is being called: https://github.com/adrianbj/PageProtector/blob/master/PageProtector.module#L212

It would be great if you could get to see if it is called and then work your way through to make sure that this line: https://github.com/adrianbj/PageProtector/blob/master/PageProtector.module#L280 is being triggered. 

I would go with:

wire('log')->save('debug', 'test');

or something similar to make sure each point in the code is being called. 

BTW - there is no need to manually create the login form on the login template page - just echo $loginForm and the module will take of that for you (but that shouldn't stop it from working). 

On another note - I see that you have the homepage protected - there is no need to protect any child pages separately unless you have specific roles assigned, but that doesn't seem to be the case - but again that shouldn't stop this from working.

  • Like 1

Share this post


Link to post
Share on other sites

Thanks for your reply, I will look into this after the weekend. Thanks for the debugging tips, hopefully I will find out the problem myself :)

Share this post


Link to post
Share on other sites

@adrian, thanks for your input! I managed to debug and I got the module to work except for one little thingy.

I checked "protect entire site" - yet when I destroy the user's session and direct them to the homepage. I found that when I redirect the user, the login template isn't popping up. Obviously this could be because the script redirects to the homepage. Is there a way to redirect the user to the login template?

Thanks for your time, it helped me an awefull lot!

Share this post


Link to post
Share on other sites
@adrian, thanks for your input! I managed to debug and I got the module to work except for one little thingy.

Glad to hear - if you have a minute, it would be great if you could explain what was wrong so others might learn. 

I checked "protect entire site" - yet when I destroy the user's session and direct them to the homepage. I found that when I redirect the user, the login template isn't popping up. 

Are you saying that despite the homepage being protected, guest visitors are having full access to the homepage?

Obviously this could be because the script redirects to the homepage. Is there a way to redirect the user to the login template?

Is this your script that is redirecting to the homepage, or the PP module? Remember that the login form is injected into the currently viewed page - it is not a separate page. 

Share this post


Link to post
Share on other sites

Glad to hear - if you have a minute, it would be great if you could explain what was wrong so others might learn. 

Are you saying that despite the homepage being protected, guest visitors are having full access to the homepage?

Is this your script that is redirecting to the homepage, or the PP module? Remember that the login form is injected into the currently viewed page - it is not a separate page. 

I fixed it by creating an actual login page (including template) to redirect to.

Share this post


Link to post
Share on other sites

There were two problems in my case. First problem was a conflict between a module I use called AIOM (All-In-One Minifier). The AIOM module caused an error just before the Page Protector module was triggered. When I enabled the debug logging I found out about this bug as there was no exception thrown. 

The second error was the way I structured the templates; I used one template file called main.php which automatically includes a controller and a view based on the template name. As there was no real template loaded, it created a blank error page.

Although the chance is rare that someone will ever stumble upon the same errors as I did, I hope this might help someone out - someday.

Share this post


Link to post
Share on other sites

In case any new users end up here, just make sure you've logged out all users of the admin area before you're convinced the module doesn't work. 

Had my 15 minutes of *FacePalm* today.

 

  • Like 1

Share this post


Link to post
Share on other sites
2 minutes ago, FrancisChung said:

In case any new users end up here, just make sure you've logged out all users of the admin area before you're convinced the module doesn't work. 

Had my 15 minutes of *FacePalm* today.

 

Or use the User Switcher in Tracy so you can test easily :)

https://processwire.com/blog/posts/introducing-tracy-debugger/#user-switcher

 

  • Like 1

Share this post


Link to post
Share on other sites

I was installing Page Protector on 1 of my websites, and I selected the options Protect Hidden / Unpublished Pages and also their children options and I got the following error.

I had to rollback the Database and just leave all the options as default and it seems to work then.

I'm using PW 2.7.x on that site.

 

I think on my other site, I was just using the default options so I didn't have this problem previously.

 

Error: Exception: Method Page::hasStatus does not exist or is not callable in this context (in /is/htdocs/wp12420480_J71V5E124H/www/sprach-dev/wire/core/Wire.php line 350)

#0 [internal function]: Wire->___callUnknown('hasStatus', Array)
#1 /is/htdocs/wp12420480_J71V5E124H/www/sprach-dev/wire/core/Wire.php(387): call_user_func_array(Array, Array)
#2 /is/htdocs/wp12420480_J71V5E124H/www/sprach-dev/wire/core/Wire.php(325): Wire->runHooks('callUnknown', Array)
#3 /is/htdocs/wp12420480_J71V5E124H/www/sprach-dev/wire/core/Wire.php(329): Wire->__call('callUnknown', Array)
#4 /is/htdocs/wp12420480_J71V5E124H/www/sprach-dev/wire/core/Wire.php(329): Page->callUnknown('hasStatus', Array)
#5 /is/htdocs/wp12420480_J71V5E124H/www/sprach-dev/site/modules/PageProtector/PageProtector.module(179): Wire->__call('hasStatus', Array)
#6 /is/htdocs/wp12420480_J71V5E124H/www/sprach-dev/site/modules/PageProtector/PageProtector.module(179): Page->hasStatus(2048)
#7 /is/htdocs/wp12420480_J71V5E124H/www/sprach-dev/wire/core/Wire.php(409): Pag
This error message was shown because you are logged in as a Superuser. Error has been logged.

 

Share this post


Link to post
Share on other sites

Hi @FrancisChung - I can't seem to reproduce this and I have been using those settings for over a year on one site.

Is there a certain action that triggers the error or is it simply trying to view the page on the frontend? 

Could you possibly try on a fresh/different PW install?

If you have Tracy installed, could you try:

bd($p->id.':'.$p->status);

on line 165 - after $p is defined on 164.

It seems like $event->object is not returning a page object for some reason in your scenario, but I don't know why.

Share this post


Link to post
Share on other sites
On 9/15/2016 at 10:45 PM, adrian said:

Hi @FrancisChung - I can't seem to reproduce this and I have been using those settings for over a year on one site.

Is there a certain action that triggers the error or is it simply trying to view the page on the frontend? 

Could you possibly try on a fresh/different PW install?

If you have Tracy installed, could you try:


bd($p->id.':'.$p->status);

on line 165 - after $p is defined on 164.

It seems like $event->object is not returning a page object for some reason in your scenario, but I don't know why.

Hi @Adrian,  I'm planning to upgrade our base PW when I get a chance so I will try out again then.
The  "Protect Hidden / Unpublished Pages and also their children options" are redundant options for the site, come to think of it.

I'll also try using Tracy as it's something on the planner to have a detailed look at it.

Share this post


Link to post
Share on other sites

I use this on a site. It used to work fine. Now when I login on the frontend, I get this error with debug on:

Fatal error: Exception: Please wait at least 35 seconds before attempting another login. (in /kunden/348019_70794/rp-hosting/14027/64026/fabriciusstrasse/wire/modules/Session/SessionLoginThrottle/SessionLoginThrottle.module line 97) #0 /kunden/348019_70794/rp-hosting/14027/64026/fabriciusstrasse/wire/modules/Session/SessionLoginThrottle/SessionLoginThrottle.module(65): ProcessWire\SessionLoginThrottle->allowLogin('kunde') #1 /kunden/348019_70794/rp-hosting/14027/64026/fabriciusstrasse/wire/core/WireHooks.php(619): ProcessWire\SessionLoginThrottle->sessionAllowLogin(Object(ProcessWire\HookEvent)) #2 /kunden/348019_70794/rp-hosting/14027/64026/fabriciusstrasse/wire/core/Wire.php(373): ProcessWire\WireHooks->runHooks(Object(ProcessWire\Session), 'allowLogin', Array) #3 /kunden/348019_70794/rp-hosting/14027/64026/fabriciusstrasse/wire/core/Session.php(712): ProcessWire\Wire->__call('allowLogin', Array) #4 /kunden/348019_70794/rp-hosting/14027/64026/fabriciusstrasse/wire/core/Session.php(712): ProcessWire\Session->allowLogin( in /kunden/348019_70794/rp-hosting/14027/64026/fabriciusstrasse/index.php on line 64

Error: Exception: Please wait at least 35 seconds before attempting another login. (in /kunden/348019_70794/rp-hosting/14027/64026/fabriciusstrasse/wire/modules/Session/SessionLoginThrottle/SessionLoginThrottle.module line 97)

#0 /kunden/348019_70794/rp-hosting/14027/64026/fabriciusstrasse/wire/modules/Session/SessionLoginThrottle/SessionLoginThrottle.module(65): ProcessWire\SessionLoginThrottle->allowLogin('kunde')
#1 /kunden/348019_70794/rp-hosting/14027/64026/fabriciusstrasse/wire/core/WireHooks.php(619): ProcessWire\SessionLoginThrottle->sessionAllowLogin(Object(ProcessWire\HookEvent))
#2 /kunden/348019_70794/rp-hosting/14027/64026/fabriciusstrasse/wire/core/Wire.php(373): ProcessWire\WireHooks->runHooks(Object(ProcessWire\Session), 'allowLogin', Array)
#3 /kunden/348019_70794/rp-hosting/14027/64026/fabriciusstrasse/wire/core/Session.php(712): ProcessWire\Wire->__call('allowLogin', Array)
#4 /kunden/348019_70794/rp-hosting/14027/64026/fabriciusstrasse/wire/core/Session.php(712): ProcessWire\Session->allowLogin(

This error message was shown because: site is in debug mode. ($config->debug = true; => /site/config.php). Error has been logged.

 

Share this post


Link to post
Share on other sites
11 minutes ago, adrian said:

Does this error happen repeatably on the frontend, but not via the normal admin login?

jep. its only when I try to login on the frontend

Share this post


Link to post
Share on other sites

Silly question, but are you using the same username on frontend and admin logins?

What happens if you wait 35 seconds - can you then login successfully?

Any sign of weirdness in your session_login_throttle database table? Perhaps you could empty that table?

Share this post


Link to post
Share on other sites
7 minutes ago, adrian said:

Silly question, but are you using the same username on frontend and admin logins?

What happens if you wait 35 seconds - can you then login successfully?

Any sign of weirdness in your session_login_throttle database table? Perhaps you could empty that table?

Thx for your quick reply!
For the frontend I created a new user with just the guest role assigned.
I can't test the Login right now, I had to disable the page protection, because the website is live and the customer is a little nervous right now :)
I will test it later in the evening. 

Iam still a newbi. Where can I find the session_login_throttle database table and how can I empty it? 

Share this post


Link to post
Share on other sites

Ok, well let me know when you can test again later. I am guessing the error was appropriate at the time, and not related to this module.

Don't worry about the session_login_throttle database table at this stage.

  • Like 1

Share this post


Link to post
Share on other sites

could this be a problem with to many people logging in at the same time?
The customer had send a newsletter with the frontend Login, so there could be multiple people accessing the login at the same time.
Also the error happened everytime the customer or I  tried to login.

Share this post


Link to post
Share on other sites

If everyone has the same login username, then absolutely - that is what the session login throttle is designed to do. I think your quickest solution will be to disable the SessionLoginThrottle module.

Just wanted to get that option to you quickly - I'll post some better solutions in a minute.

  • Like 1

Share this post


Link to post
Share on other sites

Actually now that I think about it - I actually wonder if there is a bug in the throttle module because I thought it should only record failed login attempts, not successful ones - just investigating now.

I can trigger the ban by successfully logging in out quickly several times.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now


  • Recently Browsing   0 members

    No registered users viewing this page.

  • Similar Content

    • By netcarver
      Part 1 of a 2 part Module & Service Reveal.
      I'm currently working on a new module: ModuleReleaseNotes that was inspired by the work I originally did on making Ryan's ProcessWireUpgrades module "release" aware. In the end, I decided to ditch the approach I was originally taking and instead work on a module that hooked in to the UpgradeConfirmation dialog and the module edit page.
      Aims
      My aims for this module are as follows...
      Make discovery of a module's changes prior to an upgrade a trivial task. Make breaking changes very obvious. Make reading of a module's support documentation post-install a trivial task. Make module authors start to think about how they can improve the change discovery process for their modules. Make sure the display of information from the module support files/commit messages doesn't introduce a vulnerability. Looking at these in turn...
      Making discovery of a module's changes prior to upgrade a trivial task.
      This is done by adding a "What's changed section" to the upgrade confirmation dialog.  This section takes a best-effort approach to showing what's changed between the installed version and the updated version that's available via the module repository.
      At present, it is only able to talk to github-hosted repositories in order to ask them for the release notes, the changelog file (if present) and a list of commits between the git tag that matches the installed version and the tag matching the latest version.
      It will display the Release Notes (if the author is using the feature), else it will display the commits between the tags (if tagging is used by the module author) else it will show the changelog file (if present) else it will show the latest N commits on the master branch (N, of course, being configurable to your liking.)
      An example of the Github Release Notes pulled in for you, taken from Mike Rockett's TextformatterTypographer Module...

      An example of a tag-to-tag commit list from the same module...

      An example of a changelog - formatted to show just the changes (formatting styles will change)...

      Finally, an example of a fallback list of commits - sorry Adrian ...

       
      Making breaking changes obvious.
      This is currently done by searching for a set of configurable search strings. Later versions may be able to support breaking change detection via use of Semantic Versioning - but this may require some way of signalling the use of this versioning standard on a module-by-module basis.
      For now, then, you can customise the default set of change markers. Here I have added my own alias to the list of breaking change markers and the changes section of the changelog is styled accordingly (these will be improved)...

       
      Make reading of a module's support documentation, post-install, a trivial task.
      This is done by making some of the support files (like the README, CHANGELOG and LICENSE files) readable from the module's information/settings screen. There is an option to control the initial open/closed state of this section...

      Here is Tracy's README file from within the module settings page... 

       
      Make module authors start to think about how they can improve the change discovery process for their modules.
      There are notes in each of the sections displayed on the upgrade confirmation page that help authors use each of the features...

       
      Make sure display of external information doesn't introduce a vulnerability.
      This is an ongoing concern, and is the thing that is most likely to delay or prevent this module's release lead to this module's withdrawl should a vulnerability be found. Currently, output is formatted either via Markdown + HTML Purifier (if it was originally a Markdown file) or via htmlspecialchars() if it has come from a plaintext file.
      If you discover a vulnerability, please get in contact with me via the forum PM system.
       
      Ongoing...
      For now, I've concentrated on integration with GitHub, as most people use that platform to host their code. I know a few people are hosting their repositories with BitBucket (PWFoo comes to mind) and some with GitLab (Mike Rockett?) and I would eventually like to have adaptor implementations for these providers (and perhaps GitKraken) - but for now, GitHub rules and the other hosts are unsupported.
       
      Links
      Github: ModuleReleaseNotes
      PW Module Repository: Here
    • By FrancisChung
      Hi,
      I was wondering if anyone knew what this did? 

      If so, do you know what modules it actually impacts? Is there another log that lists the action it took?

      I'm having some weird problems with PHP duplicate declaration per link below, since this module was run.
       
       
    • By tpr
      AdminOnSteroids
      Various admin tweaks to enhance ProcessWire admin.
      http://modules.processwire.com/modules/admin-on-steroids/
      https://github.com/rolandtoth/AdminOnSteroids

    • By Macrura
      Field Descriptions Extended
      This module enables you to extend field descriptions by dividing short descriptions with a longer text that is revealed in a toggle.
      Github: https://github.com/outflux3/FieldDescriptionsExtended
      Extending your field descriptions using the standard field's description field.
      Once this module is installed, it will automatically search your description field for the presence of 5 dashes (-----).
      Any content above the 5 dashes will be visible and the content below the dashes will be hidden. A 'More...' link will appear at the end of the short description which when clicked will reveal the rest of the description.
      Using Simple Markdown Editor with the description field
      If you have Simple Markdown Editor (InputfieldSimpleMDE) installed, you can enable the field description to have that editor.
      *When using Simple MDE, you can use the button (Insert Horizontal Line) instead of typing 5 dashes. More about SimpleMDE.
      Extending your field descriptions using content from a ProcessWire Page for the field description.
      You may use the content from a ProcessWire page as a field description. This would allow you to easily insert images, links, and use hanna codes.
      To use page content for your field descriptions, please follow these instructions:
      Install Select Fields module (FieldtypeFields) http://modules.processwire.com/modules/fieldtype-fields/ Create a new field using this field type, e.g. field_select. Add the field to any template you will be using for your field descriptions. Setup your help pages (for example under a settings branch) where you will store the field description content,using the template containing the Field Select. Add content to a page and select the field where that content should show. To show a short text before the link to the longer content, separate them with 5 dashes Be sure to update your settings on this page, first enable page content descriptions,then specify the name of the Select Fields field, template to search, and content field. If you create a field description using this method, please note that the description field must be blank for contexts where you want the page content to appear.
      You can freely use template context for field descriptions, but the Page Content method is not context sensitive and will display under all contexts where the description is blank.
      ----
      original post:
      This is a new module, hope to release soon, which allows extended field descriptions, in currently 2 ways.
      The main feature of the module is that you can have a short description and then a 'more...' link which drops down a longer block of text.
      This is achieved by separating the intro/visible text and the rest with 5 dashes.

      Example setup:

      the 2nd way is if you are using AdminThemeUiKit, you can show extended field instructions in a panel. The content of the panel is edited on a regular PW page. This use case would probably not be that common, but if you had a field that required some extended instructions for how to use, this could be useful; Also, since this allows you to target information and instructions down at the field level, it could reduce the amount of documentation needed on a global level, since it is a lot more context targeted.