adrian

Page Protector

Recommended Posts

16 minutes ago, adrian said:

If everyone has the same login username, then absolutely - that is what the session login throttle is designed to do. I think your quickest solution will be to disable the SessionLoginThrottle module.

Just wanted to get that option to you quickly - I'll post some better solutions in a minute.

I just testet it and now it seems to work fine!
Thanks for your support! 
I have deactivated the SessionLoginThrottle module. Is this bad for security reasons or is it save to leave it deactivated?

Share this post


Link to post
Share on other sites
1 minute ago, jploch said:

I have deactivated the SessionLoginThrottle module. Is this bad for security reasons or is it save to leave it deactivated?

No, you shouldn't leave it deactivated - it is designed to reduce dictionary login attacks.

I have just messaged Ryan to see if I can find out more about the behavior of the module also recording successful logins. If that can't be changed, then you may need to set up your own access control if you want to give all users just one login account. Stay tuned - I don't want to send you down the path of setting up something else until I hear from Ryan about the behavior of this module.

  • Like 2

Share this post


Link to post
Share on other sites

Around line 672 when checking template files you could add the $config->templateExtension too, eg.

if (!$item->isDir() && in_array(pathinfo($item, PATHINFO_EXTENSION), array(wire('config')->templateExtension, 'php', 'inc'))) {

This allows selecting twig/latte/etc files from the module settings.

However I'm still trying to figure out why $loginForm is not available for me (using Latte). Surely it's something in my code, but any chance to add $loginform to page, etc. $this->wire('page')->loginForm = $loginForm (before line 291)? This would allow using the form anywhere in the selected template. I'm using this now and it's working fine.

 

pplf1.png

  • Like 1

Share this post


Link to post
Share on other sites

@adrian

How about adding "required" html5 attributes to username/pass input fields? Plus updated the above screenshot to a non-stock login form :)

  • Like 3

Share this post


Link to post
Share on other sites

Hi @tpr - I have made all those requested changes and also several other updates to the module. Please let me know if you find any problems.

 

  • Like 2

Share this post


Link to post
Share on other sites

Great, thanks! Everything's working fine at first look.

$p->loginForm = $loginForm; // added to allow support for latte

It's not exclusive to Latte as you can use it anywhere in regular PHP templates.

Today I noticed an issue with protecting child pages. Links to child pages under a protected page was accessible to everyone, even though I've checked to protect child pages (at Page level). I've added session redirects to solve it temporarily but I'm curious if this happens for others too.

Also the site search could find content from protected child pages. Is the module taking care of this or should developers handle such cases?

Share this post


Link to post
Share on other sites
2 minutes ago, tpr said:

It's not exclusive to Latte as you can use it anywhere in regular PHP templates.

Sure, it's just a little weird though as $loginForm should work everywhere in regular templates - at least it has in my testing.

 

3 minutes ago, tpr said:

Today I noticed an issue with protecting child pages. Links to child pages under a protected page was accessible to everyone, even though I've checked to protect child pages (at Page level).

No problem here - would you mind doing a little testing in the isProtected() function to see where it might be failing. Is $pagesToCheck including the parent which is protected? Is $this->matchedParent being populated with this page? etc

 

9 minutes ago, tpr said:

Also the site search could find content from protected child pages. Is the module taking care of this or should developers handle such cases?

This module is designed to protect access to pages - I am not sure that it should actually prevent pages from being found. I am happy to revisit though if you think otherwise - it should be easy enough to do.

  • Like 1

Share this post


Link to post
Share on other sites

Ok, I'll check what could cause child pages being accessible, probably a few days later.

If it's not too complicated I would welcome an option to exclude protected pages from being found. If I lock a room for a reason I don't want anyone to sneak in through the window :)

  • Like 2

Share this post


Link to post
Share on other sites
1 minute ago, tpr said:

If I lock a room for a reason I don't want anyone to slip in through the window

Yeah, but they won't be able to get in the window, they'll just be able to see the curtains :) 

I would think you'd still want your users to be able to search for the members area - no?

Share this post


Link to post
Share on other sites

Sure, they could only have a peek :)

In this particular project it's not relevant if users could find the Members Area or not, but in general yes, it should be findable.

Share this post


Link to post
Share on other sites
1 minute ago, tpr said:

but in general yes, it should be findable

So doesn't that mean that you agree that there isn't a need to prevent search from finding protected pages?

I guess perhaps it all depends on what you are returning on your search page - if you are providing a preview of some of the content, then I guess this becomes an issue. I guess I'll make it configurable.

BTW - thanks for looking into the child pages issue - I can't imagine why it's not working at your end.

Share this post


Link to post
Share on other sites

Yes, it depends. Perhaps only its title should be findable though I guess this adds another level of complexity. Does the module add a page property eg isProtected to let devs handle this? Sorry I can't look into the code atm.

What's more important imo is to exclude child pages from search, if they are also protected. Perhaps the abovementioned isProtected property could help here too.

  • Like 2

Share this post


Link to post
Share on other sites

@tpr - I am attaching a new version of the module which rejigs things a bit. It now lets you do:

if($page->protected()) {

It returns false or the id of the page that is protecting the checked page, which could be itself, or the closest protected parent.

This should let you handle your search results however you want. 

I thought about automatically removing protected pages from results, but I think there are just too many contingencies to do it this way - I think it makes more sense to let the dev handle it via protected()

Please let me know how this goes and also if it by chance fixes your issue with child pages not being protected.

 

PageProtector.zip

  • Like 3

Share this post


Link to post
Share on other sites

Thanks!

Search results

I can easily exclude the protected pages now but I guess there's no way I could exclude them in the initial $pages->find() query, where search results are populated. This leads to improper number of results if I exclude pages when outputting the results list, or if I filter them in memory beforehands then pagination will broke. This is no surprise because $page->protected is not a page field so I cannot use "protected=''" in the selector. I've tried using addHookProperty but $pages->find() doesn't respect that ($page->protected worked fine though).

Anyway, I can live with it - but please correct me if I'm missing something.

Child pages

In case of child page protection I found that if I set no template in the module settings, then the protected child page loads with the loginForm, which is the expected behaviour. This unfortunately doesn't fit my current needs because I would prefer only one login page for members, so that's why I do a redirect:

if ($page->id !== $memberLoginPage->id && $page->protected() && !($user->isSuperUser() || $user->hasRole('member'))) {
    $session->redirect($memberLoginPage->url);
    $this->halt();
}

Would it be possible to have an option under "Protect child pages" like "Redirect to protected parent on direct access"?

  • Like 3

Share this post


Link to post
Share on other sites

Hey @tpr - thanks for the report.

I'll take a look at the issue with protected() and trying to make the property available in find() selectors - not sure if this is possible or not.

Regarding the child issue - it is working here if use the default login form and also if I choose a login template - that is both options seem to be working fine. Perhaps it's a Latte issue when using wireRenderFile like I am around line 304 ?

1 hour ago, tpr said:

This unfortunately doesn't fit my current needs because I would prefer only one login page for members, so that's why I do a redirect

I don't really understand this - users should see the same login form no matter what page they try to visit (because it renders the template you have chosen) - I don't see any reason to redirect - again, maybe a latte issue? Any chance you could try the module without latte just to see if everything works as expected? Maybe I am still not understanding though?

  • Like 1

Share this post


Link to post
Share on other sites

@tpr - just had a quick play with a protected property and selectors. Runtime properties only work with in memory page arrays, so you would have to do:

$allResults = $pages->find("template=basic-page");
$notProtectedResults = $allResults->find("protected=0");

I think you already figured this out :)

Anyway, that example works with the attached version.

What are your thoughts on the best approach here? 

 

 

PageProtector.zip

  • Like 2

Share this post


Link to post
Share on other sites
5 hours ago, tpr said:

I can easily exclude the protected pages now but I guess there's no way I could exclude them in the initial $pages->find() query

I guess you could add a couple of hidden fields to your page templates to store the "Protect children" and "Allowed roles" values using a save hook. Then make use of these fields in your find selector.

Share this post


Link to post
Share on other sites
2 minutes ago, Robin S said:

I guess you could add a couple of hidden fields to your page templates to store the "Protect children" and "Allowed roles" values using a save hook. Then make use of these fields in your find selector.

Yeah,  I was hoping to avoid that - I never like polluting all templates with settings type fields if I can avoid it, but maybe in this case it is the only option. I guess if it's set to hidden and system so it can't be manually deleted (but deletion is taken care of during module uninstall), and its checked status would be toggled when checking the "Protect this page" checkbox on the Settings tab, then it wouldn't be too invasive. The other catch of course is that protecting a parent that has thousands or more children could result in a very slow page save because it would need to update the status of all those children as well.

Share this post


Link to post
Share on other sites
4 minutes ago, adrian said:

Yeah,  I was hoping to avoid that

Sorry, I wasn't proposing that as a module feature - just a suggestion for @tpr to consider. I think it's something that most users don't need so I agree it shouldn't be implemented by the module.

7 minutes ago, adrian said:

The other catch of course is that protecting a parent that has thousands or more children could result in a very slow page save because it would need to update the status of all those children as well.

Rather than do that I was thinking a person would use has_parent in their $pages->find() selector.

$page_protects_children = implode('|', $pages->findIDs("protect_children=1"));
$results = $pages->find("has_parent!=$page_protects_children"); // actual selector would have more conditions

 

  • Like 1

Share this post


Link to post
Share on other sites

Adding a field manually should work, thanks. As I wrote, memory selectors would make pagination to fail, but with the extra field it will be OK. I only need to add it to the protected parent and use has_parent.

I'll check the child issue without latte too.

I need the redirect because if one tries to access a child page by knowing its url, I would like redirect him to the protected parent. This page has different template with the login form.

  • Like 1

Share this post


Link to post
Share on other sites

Child page protection is kinda working OK but there's an issue if you select a login template and use fields that are also available on the child pages, eg. $page->body, which is quite common. Sensitive data may be rendered (eg. with $page->body), because the actual (child) page fields are passed to the login template file.

One needs to check $page->loginForm (or $loginform, $page->protected/protected()) and display the form or other page content. In such cases a redirect to protected parent (the login page) would be safer.

Btw you uploaded the "ProtectedMode" module here, is that intentional?

ppcp.gif

ppcpt.png

Share this post


Link to post
Share on other sites
12 minutes ago, tpr said:

OK but there's an issue if you select a login template and use fields that are also available on the child pages

That's not the intention of this approach - the login template you select should be a dedicated template file (it shouldn't really even have a PW template associated with it). The only thing it should echo is the head, footer, etc and $loginForm - that is it! I believe if you follow that approach everything should work as expected and be secure with no need to redirect. Sorry if that's not clear.

 

12 minutes ago, tpr said:

Btw you uploaded the "ProtectedMode" module here, is that intentional?

Sorry about that - silly mistake - I have now replaced it with the PageProtector version I was referencing.

 

 

Share this post


Link to post
Share on other sites

Thanks, that wasn't clear to me reading the module description/notes fields. Perhaps I was thinking in a "redirect mode" instead of wireRenderFile so I thought all other fields will come from the protected parent and not from the actual child page. Maybe it's only me but perhaps a warning text could be added to the description field to not to place other dynamic content to this template file?

Btw, if I would like to add multi-language content before the $loginForm do I need to use $myLoginPage->body or is there another way? (this was the purpose of using $page->body in my login template, having a dynamic text coming from the admin).

Share this post


Link to post
Share on other sites
16 hours ago, tpr said:

Perhaps I was thinking in a "redirect mode" instead of wireRenderFile so I thought all other fields will come from the protected parent and not from the actual child page.

Perhaps I should add another variable ($ppid - protected page id) to the array that is passed to wireRenderFile. This would be the id of the page that is protected, whether that is the current page, or the parent which is protecting it. That way you could do a $pages->get($ppid)->body to get the appropriate text. Would that be useful? Attached version has this if you want to try it out.

Does that idea also help with your multi-language content question? I don't think I am totally following what you need there.

PageProtector.zip

  • Like 1

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now


  • Recently Browsing   0 members

    No registered users viewing this page.

  • Similar Content

    • By kixe
      Email Verification
      This module provides functions to validate email adresses and hosts. The module generates a textfile for blacklisted mailhosts (trashmail), which will be always up to date.
      Download
      https://modules.processwire.com/modules/email-verification/
      API
      // get module $mailcheck = $modules->get('EmailVerification'); // return bool/ string - automatted update of blacklist file $mailcheck->blacklisted(email|domain) // return bool - validate a top level domain, checks against IANA list $mailcheck->validTLD(tld) // return array of punycoded TLDs - cyclic updated, data pulled from IANA $mailcheck->getTLDs(cycle=2592000) // return bool - checks syntax converts to punycode $mailcheck->validDomainName(domain); // return bool - checks punycode encoded syntax $mailcheck->validHostName(host); // return bool - checks syntax and accessibility $mailcheck->validHost(email|domain) // add a single value to blacklist $mailcheck->addToBlacklist(email|domain) USAGE
      $mailcheck = $modules->get('EmailCheck'); $email = 'susi@trashmail.com'; if($mailcheck->blacklisted($email)) echo 'Email Provider not allowed'; if(!$mailcheck->validHost($email)) echo 'Mailhost not available'; Example blacklist file:  blacklist.txt
       
    • By teppo
      Code Blocks Textformatter is a tiny Textformatter module I cooked up to add support for code blocks to text/textarea/RTE fields on some of the sites I work with. Unlike a full-blown Markdown Textformatter – which is something that we already have in the core – this module simply adds support for fenced and inline code blocks.
      The syntax is based on the GitHub code block documentation, so please refer to that for additional instructions. The README at GitHub also includes some basic examples. As with any Textformatter, in order to enable this one, install it and enable it via field settings. Note that there's no syntax highlighting built in (at least for the time being), so use a tool of your choice for that – personally I prefer Prism.js.
      Since this module doesn't use a Markdown tool behind the scenes, but rather some home baked regular expressions, there's always the possibility that I've missed something – but please let me know if you use this module and run into any issues. On the other hand this module should be relatively fast and unobtrusive, as there are no unnecessary bits of code to run 
      GitHub repository: https://github.com/teppokoivula/TextformatterCodeBlocks Modules directory: http://modules.processwire.com/modules/textformatter-code-blocks/
    • By theo
      Here is my first processwire module (beta).
      https://github.com/theo222/ImagePickerField
      A lot of "first times". First time Github, Markdown and of course PW Modules.
      So be gentle please.
      I hope it works.

    • By horst
      Image Animated GIF  v 2.0.2
       
      Module for PW 2.5 stable or newer, but is obsolete for PW Versions greater then 3.0.89 (... read more ...)
       
      This module helps with resizing and cropping of animated GIFs when using the GD-Library.
      The GD-Library does not support this.


      This module is completely based upon the fantastic work of

         László Zsidi (http://www.gifs.hu/, builts the initial classes)
         xurei (https://github.com/xurei/GIFDecoder_optimized, enhanced the classes)


      I have ported it to a PW module and it works with core imagefields, together with Pia and with CropImagefields that uses the new naming scheme since PW 2.5.
       
      ------------------------------------------------------------------------------------------------------------------------------------------
      read more in this post about the rewrite from version 1.0.0 to version 2.0.0
      ------------------------------------------------------------------------------------------------------------------------------------------
      You can find it in the modules directory: https://modules.processwire.com/modules/image-animated-gif/
      and on Github: https://github.com/horst-n/ImageAnimatedGif
      ------
      A preview can be found here