I recently discovered a problem with access rules in Drupal 6 by accident.
goto admin/user/rules, add a rule and name it "%_%".
There is a hint that tells you that "_" means ANY character.
I didn't see that hint and wanted to exclude the "_" of usernames.
So If you do so, you forbid ALL users to log in into your site, even admin.
I was lucky that I had another browser open with the page as admin (login cookie set) - so I could delete the rule again.

Possible solution: forbid to create rules that are named "%_%" or anything that renders admin unusable.

Comments

Status: Active » Closed (outdated)

Automatically closed because Drupal 6 is no longer supported. If the issue verifiably applies to later versions, please reopen with details and update the version.