protected node not redirecting properly when anonymous user

I went to your page and it didn't work, indeed. I can see a session identifier which makes me think that the session cookies are working just fine. However, when I enter the password and click OK, it comes back. This is the expected behavior when the password is accepted by somehow the page doesn't get unlocked.

I use the module on that site with the most famous top secret password: password1

http://gallery.m2osw.com/another-form-which-protected

As you can see it opens...

I use a similar set of modules as you, only I never use the devel or admin_menu. You could try to remove them and see whether you still have the problem. I really don't see why any other one would generate a problem otherwise.

Let me know whether these modules interfere and removing them fixes the problem.

Thank you.
Alexis Wilke

Yes. i18n, if I recall properly, will eventually redirect you from one page to another. That could be a problem. But if you try to remove it, I'm afraid it could hurt your data!

Now testing with another install would be a good idea and create a page that has the same set of translation like the one you directed us to in this issue. That way you would replicate the problem exactly.

Anyway, if you can look at the code, the protected_node.module has a protected_node_init() function that checks whether the node is (still) locked. It calls the protected_node_is_locked() function for that purpose.

In that is locked function we check a session variable:

  if (isset($_SESSION['_protected_node']['passwords'][$nid])) ...

If that session variable never gets set, then the module will always prevent access to that node. Some other module could prevent the variable form getting set. This is done in the redirect functions which are found in:

protected_node/protected_node.redirect.inc

The very function setting the _SESSION variable is protected_node_enterpassword_submit(). The function just before that validates the data.

What you can do to check that it does (or not) go in those functions is use a watchdog() call. The drupal_set_message() may work too, although that does not always work as expected.

watchdog('rikis', 'validating...', array(), WATCHDOG_WARNING);

You may use WATCHDOG_ERROR as well. Then those messages will appear in your logs so you can see whether an expected code path is taken or not. For example, the validation may run properly but then someone else redirects the user in some way which means the user ends up back on the same password page because it has not been in the protected_node_enterpassword_submit() function and thus never got a chance to set the _SESSION variable.

Thank you.
Alexis