Allow some (registered) users to bypass the maintenance site

WARNING: having users working on a site while it is being modified/updated is potentially dangerous. Data may be lost corrupted and may even cause your site to cease to function. You have been warned.

Having said that, the code that actually does the check for offline mode is in includes/menu.inc. The relevant function is pasted here.

<?php
function _menu_site_is_offline() {
  // Check if site is set to off-line mode
  if (variable_get('site_offline', 0)) {
    // Check if the user has administration privileges
    if (!user_access('administer site configuration')) {

I would create a new permission in a custom module.

<?php
function custom_perm() {
  return array('bypass maint');
}

Then change the menu.inc code to include a check for the new permission like so:

<?php
function _menu_site_is_offline() {
  // Check if site is set to off-line mode
  if (variable_get('site_offline', 0)) {
    // Check if the user has administration privileges
    if (!user_access('administer site configuration') || !user_access('bypass maint')) {

Then enable the new module, assign the 'bypass maint permission' to the appropriate role/roles and they will be able to use the site as normal while it is in maintenance mode. Oh yeah, and if the site blows up on you... see the first line of this post.

Inline with the above post I must beg the question why? Perhaps if you explain what it is you are looking to do with this we could propose a better, safer solution. You will inevitably need the Maintenance system at some point and will likely wish you hadn't cannibalized it for another purpose somewhere down the road.

Instead of writing a separate module, what about not using maintenance mode, and instead, temporarily remove the 'access content' permission for anonymous users? (putting up an appropriate page for the access denied error page)

------------------------------
http://fraggles.artsci.wustl.edu (Drupal user documentation and development blog)

Oaky, so this thread has been used to demonstrate yet again how Drupal provides many ways to solve a problem. What it hasn't covered yet is best practices. Maintenance mode is a convenient way to inform users while maintaining a low load on your server while maintenance is performed. It should NOT be used for making changes to a live site. Drupal provides many mechanisms to avoid testing on a live site. High on this list is it's multisite capability. You can easily run two sites from a single code base and even share some tables between the two if needed. You can create a second site where only your "special" users can log in and test out cool new features. When they are ready for prime time that's when you use maintenance mode! Take the site down for a minute, copy the modules or themes or whatever over to the production site then turn maintenance mode off. No need to hack the core or create special bypass tokens that can be easily sniffed anyhow. It might be okay for you to turn this particular website off when you need to, but sooner or later you'll (hopefully) be running a site that you can't. Won't it be great to be able to say "no problem, I can demo those modifications to the customer?"