I would like to password protect a page or pages so a nos registered user can enter the password and see the page.

Comments

maulwuff’s picture

This is what I am looking for, too. Would it be hard to add this feature?

maulwuff’s picture

Status: Active » Needs work

I've managed to enhance the widgets functionality, by adding some modified parts of the protected-node-module.

what the code does:
ask for password (only) before editing a node. (If you want to always have a password-question, use the protected node-module.)
this works for authenticated and anonymous users!
This way, anon users can register i.e. for an event, and edit their entry later without having to register to the site.
editing is available for users who know the password or for user nr 1.

how it works:
-it leaves the original password.module code as it is. simply put the following at the end of this file.
-If a user wants to edit a node, and no session saved password is found for the node, the user will be shown a password-form (like in protected node-module)
-it does not build its own password-table like protected node does, because the password is stored by cck.

caution:
- you have to enable 'edit password content' in user access control.
- the password field has to have the name "editpassword" (when adding a new field to a content type)!! this is a point I don't know how to solve securely in a dynamic way. :/
- you can not edit from the Administer > Content management > content, because of wrong url.
- do not use this code for high security sites! parameters for the right node are shoved around in the url.
- the field can only be used in one content-type, otherwise, a new table is generated, which this patch is not able to handle.

//most parts from module "node protect"

/**
 * Implementation of hook_perm()
 * needed for redirect to password form via menuentry
 */
function password_perm()
{ 
	return array('edit password content');
}



/**
 * Implementation of hook_nodeapi()
 * 
 */
function password_nodeapi(&$node, $op, $arg = 0, $page = 0) {
	global $user;
	
	$contenttype = $node->type;
	
	switch ($op) {
      case 'load':
          //test if the node is password protected          
          $contenttype = 'content_type_'.$contenttype;					
      		$output['is_cck_protected'] = db_result(db_query('SELECT count(*) FROM {'.$contenttype.'} WHERE nid = %d', $node->nid)) > 0;
      		$output['protected_fieldname'] = $node;
      		return $output;
      	break;

    	case 'update': 
          //simple workaround to "update" the session-stored password, after editing a node (= delete password, and ask user on next edit again)
          unset($_SESSION['cck_protected_node']['passwords'][ $node->nid]);			
        break;
			
      case 'prepare': 
          //user wants to edit node -> call menulink for displaying inputform
          if($user->uid != 1){
	          if ( ($node->is_cck_protected && $node->uid !== $user->uid) ) {      			
	            if (!isset($_SESSION['cck_protected_node']['passwords'][$node->nid])) {
	              drupal_goto('cck-protected-node', 'from=' . $node->nid . '&v='.$node->vid.'&ct=' . $contenttype);
	            }
	          }
          }
        break;
  	}
}



/**
 * Implementation of hook_menu()
 * needed for calling the login window
 */
function password_menu($may_cache) {
  $items = array();
  $may_cache = true;
  if ($may_cache){
    $items[] = array(
      'path' => 'cck-protected-node',
      'title' => t('Protected node - Enter Password'),
      'description' => t('Here you can enter the password for the node'),
      'callback' => 'drupal_get_form',
      'callback arguments' => 'password_enterpassword',
      'access' => user_access('edit password content'),
      'type' => MENU_CALLBACK
      );
  }

  return $items;
}



/*********************
 * Helper functions  *
 *********************/

/**
 * Simple function to make sure we don't respond with grants when disabling ourselves.
 */
function password_disabling($set = NULL)
{
	static $disabling = false;

	if ($set !== NULL)
	{
		$disabling = $set;
	}

	return $disabling;
}

/**
 * form for entering the password
 */
function password_enterpassword() {
	if(!isset($_GET['from'])) {
		// Illegal call
		watchdog('cck_protected_node', t('Illegal call to /cck_protected-node'), WATCHDOG_WARN);
		drupal_goto('');
	}

	$form['cck_protected_node_enterpassword'] = array(
			'#type' => 'fieldset',
			'#description' => t('The node you are trying to edit is password protected. Please enter password below to proceed.'),
			'#collapsible' => FALSE
	);
	$form['cck_protected_node_enterpassword']['password'] = array(
			'#type' => 'password',
			'#title' => t('Node password'),
			'#size' => 20
	);
	$form['cck_protected_node_enterpassword']['from'] = array( //node id
			'#type' => 'hidden',
			'#value' => $_GET['from']
	);
	$form['cck_protected_node_enterpassword']['ct'] = array( //contenttype for querying the right table
			'#type' => 'hidden',
			'#value' => $_GET['ct']
	);
	$form['cck_protected_node_enterpassword']['v'] = array( //version of node
			'#type' => 'hidden',
			'#value' => $_GET['v']
	);
	$form['cck_protected_node_enterpassword']['submit'] = array(
			'#type' => 'submit',
			'#value' => t('OK'),
	);

	return $form;
}

/**
 * called after submitting, to validate input
 */
function password_enterpassword_validate($form_id, $form) {
	$contenttype = 'content_type_'.$form['ct'];
	//TODO field name is hardcoded to field_editpassword_value!!!
        //TODO recognize whether this is a single-used field, or a shared field, which means it has its own table.
	$cnt = db_result(db_query('SELECT COUNT(*) FROM {'.$contenttype.'} WHERE field_editpassword_value = \'%s\' AND nid = %d AND vid = %d', $form['password'], $form['from'], $form['v']));
	if($cnt < 1)
	{
		form_set_error('password', t('Incorrect password!'));
	}
}

/**
 * called after checking the entered password -> redirect to edit page of node
 */
function password_enterpassword_submit($form_id, $form) {
	$_SESSION['cck_protected_node']['passwords'][$form['from']] = TRUE;
	drupal_goto('node/' . $form['from'] . '/edit');
}


designanddraft’s picture

Status: Needs work » Active

drupal 6.x, v6 transparent admin
I am looking for transparent administration, open, visible and sometimes editable admin settings with security. based on permissions, locked individually (as a node?), password protected, view and/or edit choice for admin inserted at the top or bottom of all admin/settings pages. even better, password or radio button next to every settings choice as viewable and/or editable similar to form field protect. a prominent notification to the user, “you can view this page of administration settings, if they require edit, please email administration with your request link”. Possibly even attached comment or site note section, ability to insert instruction or voting widget.
I gather this is the approach taken by adding access control to the core and maybe it is similar to drupal core building. I have been looking at everything I can find and I’m not a programmer yet, so I need to pass what I’ve found on to someone else here. If someone can put these pieces together or have experience with something similar with any version 4,5,6,7. i'm listing this at all of these locations aswell. Rsvp, elisa

http://drupal.org/node/109157 access control
http://drupal.org/node/131101#comment-735943 Add disabled attribute to protected fields
http://drupal.org/node/245900 How to Protect Nodes From Editing on Demand
http://drupal.org/node/31143#comment-796152 Node Privacy by Role not working
http://drupal.org/project/nodeaccess nodeaccess
http://drupal.org/node/126129#comment-703933 password protect a page
http://drupal.org/node/222263#comment-902378 Port of Content access for D6
http://drupal.org/node/29991#comment-51352 Protected content
http://drupal.org/node/13266 Show block to certain users or roles only- Drupal 4.6
http://drupal.org/project/simple_access simple access
http://drupal.org/node/118404#comment-735895 View, but not edit, field at node/xxx/edit

Project: » Lost & found issues

This issue’s project has disappeared. Most likely, it was a sandbox project, which can be deleted by its maintainer. See the Lost & found issues project page for more details. (The missing project ID was 119769)