By Todd Young on

I would like to have an entire site publicly available - no user accounts, no logging in - where every page is viewable by anonymous users but ONLY if they know the direct path specified for any given node. I would like to BLOCK users from accessing nodes by the default "/node/xxx" URL's.

I imagine I could add something to the page template to tank the request if the URL contains "node" in it, and/or do some .htaccess tricks, but I thought there might be a more elegant way?

Comments

vikramy’s picture

vikramy commented

This is what you need.

http://drupal.org/project/globalredirect

Todd Young’s picture

Todd Young commented

Thanks for the pointer, trying it now.

From the Global Redirect notes:

For example, if you set the alias "articles/cake-making" to node/123, then the user can access the alias with any combination of case.

I'm hoping this can actually be configured to not allow the node/123 version of the URL. I am trying to prevent people from "crawling" the site by incrementing the node number. Off to try it...

Todd Young’s picture

Todd Young commented

Shoot, as I suspected... Global Redirect does not stop a user from typing "node/2" and still getting that page, even though it redirects to the assigned path. I think I'm back to the drawing board?

I'd like to block requests using the node/# but allow requests to the assigned path. Global Redirect was close - any ideas?

johnpitcairn’s picture

johnpitcairn commented

If there are no user accounts, how are you making changes? As user 1?

Rather than put something in template.php, I'd perhaps make a small module and handle it something like this (untested):

function mymodule_nodeapi(&$node, $op) { 
  global $user;
  if ($op == 'view'
      && !variable_get('cron_semaphore', '') // check if cron is running
      && !$user->uid // check user is anonymous
      && $node->path // check the node has a path set
      && strpos($_SERVER['REQUEST_URI'], base_path() . $node->path) !== 0) { // URI doesn't begin with node path?
         drupal_not_found();
         exit();
  }
}
Todd Young’s picture

Todd Young commented

Yes, only user 1. Interesting approach, thanks for the code... I'm wondering if the cron check is needed and/or if it would provide a user the ability to see the node while cron is running. I will tinker...

johnpitcairn’s picture

johnpitcairn commented

I think cron can run as anonymous - I found the check necessary to avoid cron-run errors when doing something very similar in hook_nodeapi.

Todd Young’s picture

Todd Young commented

Someone emailed me asking if I had a solution for this problem. If I can remember correctly, I believe I ended up creating a penel for that node type and put a php conditional statement in there to read the URL and test if "/node/" was in it, sending the user to 404 if it was. I think. It was some time ago.

At any rate, that should work.