The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.
By nimi on
I just discovered that after completing a new website for an organization with a private server (I will not mention their name here) they are trying to replicate it and offer it to other branches inside their organization.
I spent months working on developing this website that would fit all their requirements and now the server admin is trying to steal it :( I am completely outraged!
The problem is that the site has to be hosted on their server. There is no option of hosting it elsewhere.
How can I block access to the admin pages of my site from even the server's administrator (who has access to the database)? Is it even possible? Maybe with some kind of external log-in option?
Please help. I am extremely worried...
Nimi.
Comments
Who's website is it?
Did you make it clear before you started that you were going to retain ownership of their website once you finished working for them? Did they agree with that?
My clients own their websites. They are free to do as they wish once I've finished building them.
I don't know what the legal situation would be (not a lawyer) ... but ethically ... should you be trying to lock the System Administrator of an organization OUT of their own resources?
Did you get paid?
We haven't discussed any
We haven't discussed any legal issues before I started working. I planned however to create more projects for the rest of the branches, but the admin is offering to do it for much less now that he knows how to develop such a website.
Ethically, he is stealing from me. This is why I want to temporarily block out the admin until I finish creating the websites for the rest of the branches.
Wow, that really sucks
What a terrible situation! I've heard there are some bad stories of things going wrong because every detail wasn't laid out in a contract before work began. I'm just starting to freelance, so I don't have any experience with this kind of thing. I really hope everything works out.
Just in case this is useful to you or anyone else who may read this, here is an article in Smashing Magazine I've stumbled across recently about contracts: http://www.smashingmagazine.com/2009/10/06/freelance-contracts-dos-and-d...
Doesn't sound to me like
Doesn't sound to me like blocking them out is the right move (or even possible... after all it's their server, they have root access).
What you should do is 1) Discuss the issue with management of the organization and try to come to terms. Did you have a preexisting agreement with them to do the rest of their sites? Any other agreements about copyright, etc? If there were no specific agreements, then you were "working for hire" and I'd guess that they'd be legally allowed to do whatever they want with the data once they have paid for it. 2) Failing that, if you feel they are breaching some verbal or written agreement you had together, consider bringing them to small claims court and have the judge decide.
I have a written agreement
I have a written agreement that I am developing a site for them. This means it is a service (product) I am offering them. I'm not "hired" by them.
Technically speaking, if I were to build them a website in flash, compile it, and sell it to them then there would be no problem and I wouldn't have to protect my code.
However, because this is an open-source platform and everything is overt, i need to find a different way of protecting my rights.
Is there no such way then to protect my own code from the server admin?
Your situation is
Your situation is unfortunate. I know you're not the only one here who's "been there .... done that". I haven't had this particular circumstance, but I have had client relationships that have been strained or broken over lack of paperwork or relevant discussion (think of divorce rates, even lovers fail).
There are certainly ways to protect your work ... but only in hindsight. If your paperwork or prior discussions with them didn't address the IP rights of the project, they are going to assume they own what they've paid for (all of it).
As I said in my first comment, I claim no rights over the sites I build for clients, and they are correct to assume (they are also proudly told) they own their sites and everything produced to deliver them (graphic design files, raw data, etc).
If I was developing a non-trivial solution for a client where I intended to leverage this effort in future ventures ... I would preempt your current situation with an appropriate service agreement with the client and give them the opportunity to decline my "proprietary" solution.
I hope you can find a digestible middle-ground with your client. Good luck nimi.
I'm with Matt
When you ask, "How can I block access to the admin pages of my site from even the server's administrator " Don't you mean THEIR site? Afterall, they paid you for it.
If I were the customer, I would throw a fit if the developer locked me out of my site. This is not the proper way to handle it. I like the suggestion of having a frank discussion with them. "I thought I was going to be able to develop these other sites for you guys" works better than "Ha ha! I have locked you out of your site. Now hire me."
For years someone could hire an individual to create an HTML page and then re-skin the graphics and make a new site. And yes, even compiled SWF files can be reverse engineered. Certainly you can get the actionscript out of them. And let's face it, the vast majority of what you built for them was built on the back of the Drupal core and the contributed modules. No one is trying to hold their CCK module hostage from you.
I understand that you worked for months on their site. Maybe you didn't get paid as much as you would have wanted during this time. I recommend you look at it as an "earn while you learn" situation. The skills and the knowledge you have now are worth a great deal. The goodwill you will have with the company working WITH them instead of against them will also have value.
Good luck.
Jerry
A list of some of the Drupal sites I have designed and/or developed can be viewed at motioncity.com
Thanks Mat and Jerry
Thanks for both of your detailed replies.
I understand now why it would be unethical to lock out the sysadmin from the site's admin pages even if he's trying to steal my code. As ridiculous as it sounds I would have to let it happen.
I guess this is an inevitable problem with software in general. One must tackle the situation differently as you suggested (written agreements...).
Still it's frustrating. Oh well, only a fool makes the same mistake twice...