Entered global password doesn't persist across nodes

Good point.

> Is it intentional?
I would rephrase and say that this is an unfortunate side effect. At this time, the password is on a per node basis, indeed.

It should be doable though. Global passwords can be saved in a different session and we'd need to test that session separately. That's a bit of work...

Also, we'd need to support the node type wide global password versus the system wide password...

Do you think you could provide a patch?

Thank you.
Alexis Wilke

Yeah... I wouldn't have the time either...

Now I have been thinking of such grouping and it would probably work better with a taxonomy which terms support a password. A node assigned those terms could be protected and viewable if you enter any one password.

This is all nice, but would require quite a bit of work!

Thank you.
Alexis Wilke

I've just come across the very same issue…

The site I'm building needs to protect all nodes of a certain type, and one view, with a single password that should only be entered once per session. Since I need a view to share the password it would make sense to use the Global password approach originally discussed?

Coding a patch for this may be over my head, but I'm willing to have a go if someone could point me in the right direction.

Or, is there another module I haven't found yet that could protect, say, everything under a given url path? That could also work for me.

At this time I use the following to save the passwords:

$_SESSION['_protected_node']['passwords'][$nid]

You could create a new session entry with either the global password:

$_SESSION['_protected_node']['global']

Or make use of the node type password and create a node type session:

$_SESSION['_protected_node']['node_type'][$node->type]

Then anywhere I check the $_SESSION check the global and/or the node type sessions as well. If any one password was entered, then the user is allowed to see the page. When a password is entered, first check the global password, if that one is set, then set the global session. If the node type password is set, then set the node type session. And otherwise do as now.

Do NOT change the fork processing: protected_node/protected_node.fork.inc (it requires a specific password on a per node basis.)

The only 2 files with session checks are:

protected_node/protected_node.module
protected_node/protected_node.redirect.inc

Thank you.
Alexis

This is my first attempt (ever!) at submitting a patch to a Drupal module. Apologies if I did it incorrectly...

I updated the module to also use $_SESSION['_protected_node']['global'] variable as described in comment #5 above.

Is this a patch for d6 or d7?

You put a 6 in the filename but changed the issue version to 7.x...

It is a patch for D7. The 6 in the filename refers to the comment number in this thread, not the drupal version. I thought this was how it should be named by following the official patch guidelines (under the "Name Your Patch" heading):
http://drupal.org/patch/submit

Please correct me if I am wrong....

@beefheartfan: This patch is working for me, thanks. I've updated it to UTF-8 since it was not applying cleanly for me.

For anyone who's interested I just did this for a client running Protected Node version 6.x-1.9. I've attached a patch I created. Just like @beefheartfan, this is my first patch so I apologize if I did it incorrectly.

The patch works so that if you use only a global password, once a visitor enters the correct password once they don't have to enter it again for other protected pages while their session persists.

Any feedback of course would be welcome. Thanks.

Jonathan

Hi jg314,

The patch filename should include the Drupal version to make it easier to distinguish which patch is for which version (or post the patch in its own thread with the correct version).

It seems to me that the following is wrong:

             if ($when <= variable_get('protected_node_session_timelimit', 0) // global reset time
              || $when <= $node->protected_node_passwd_changed) {  // this page reset time
-              unset($_SESSION['_protected_node']['passwords'][$node->nid]);
+              unset($_SESSION['_protected_node']['passwords']);
             }

Because it will delete ALL the sessions, not just the sessions for that one page. With a global password, of course, the side effect is that the page is still accessible by someone with a cookie referencing any other page. If I'm correct, that's when you edit a page and I want the passwords reset for that page on the node 'update'.

Thank you.
Alexis Wilke

In #12, I rerolled a new patch against 7.x-1.x since #9 no longer applied cleanly after updating to the latest dev release. Hoping this can be tested and moved forward because when we use a global password without this patch, the body field does not display on any of our nodes.

merged #12
Thank you all