When an unprivileged user (no administer site permission) logs in when the site is offline, he can not logout anymore. Inexperienced administrators that mistakenly login as an unprivileged user, may be unable to regain access to their site until they delete the site's cookie or switch to another browser.

Steps to reproduce:

1. Create a user in a role without the 'administer site' permission
2. Set the site to offline mode
3. Log out
4. Attempt to login as the user created in 1).
5. Attempt to login as uid 1.

Issue on 5.x-dev and 4.7.x-dev

CommentFileSizeAuthor
#1 site_offline_logout.patch734 bytesedmund.kwok

Comments

edmund.kwok’s picture

edmund.kwok commented
Status: Active » Needs review
StatusFileSize
new site_offline_logout.patch734 bytes

Able to reproduce bug. I was stuck myself in the past; had to use another browser to get back to the admin account.

Took a stab and submitting a patch. Not sure if it's the best place to do this, but in menu.inc, if user has no 'administer site configuration' privileges, and if the $user->uid != 0 (non-admin user logged on), the user will be logged out and redirected to the main page with the offline message.

drumm’s picture

drumm
he/him
Location NY, US
commented
Status: Needs review » Needs work

This should provide some feedback with drupal_set_message() when that happens.

edmund.kwok’s picture

edmund.kwok commented

Hmm, drupal_goto seems to flush any drupal_set_message before of after it. Any other way to display a message? Or we'll have to use something like header()?

ahoeben’s picture

ahoeben commented

Shouldn't it be '$user->uid != 1' instead? uid==0 is the anonymous user, right?

edmund.kwok’s picture

edmund.kwok commented

Yes, uid == 0 is the anonymous user. So we're making sure only unauthorized users who logged in will be logged out. If we use uid != 1, then all other users (including authorized users) except the admin account will also be logged out.

ahoeben’s picture

ahoeben commented

Nevermind, I did not fully read in to the patch... I was worried the patch would also throw the admin out, because I did not notice the access check above.

Steven’s picture

Steven commented

Hmm, drupal_goto seems to flush any drupal_set_message before of after
it. Any other way to display a message? Or we'll have to use something
like header()?

Messages normally persist across goto calls. However, messages are kept in the session, which is destroyed when you log out.

rkerr’s picture

rkerr commented

If the site is "Offline" ... how are users (other than uid 1 or admins) able to log in at all? Seems this condition should never be allowed to occur in the first place.

Coupon Code Swap’s picture

Coupon Code Swap commented

I found this thread looking for a solution to something else that is related. I'd like to be able to demo a site that is off-line to authenticated users. I want the site to appear off-line to everyone except users that I have created a user account for so they can log in and see the site in off-line mode. However, I don't want them to have administrative privileges. Is something like this possible? I created a thread specifically for this question:

http://drupal.org/node/133748

okokokok’s picture

okokokok commented
Version: 5.x-dev » 6.17

This is still happening in 6.17 when the Default front page is set to user.
Users will try to log in and will just be redirected to the login page - even when entering proper credentials.

Status: Needs work » Closed (outdated)

Automatically closed because Drupal 6 is no longer supported. If the issue verifiably applies to later versions, please reopen with details and update the version.