Stop me if you've heard this one before…
If you have a site and you don't want anyone to see it for a while for whatever reason, you may solve that problem by taking it offline. So you put it into maintenance mode. Problem solved, right? People that aren't logged in see the "down for maintenance" message and nothing else, so they can go about their day.
…Except for the /user page, which shows the user login page exactly as it would if the site were not offline. Same menus, same blocks, etc. And if those menus and/or blocks contain or imply the same stuff that you're trying to hide and therefore took the site offline for in the first place… well, it defeats the purpose, doesn't it?
The proposed solution is for the /user page to contain only the user login form with no blocks, menus, etc just like the "down for maintenance" page when the site is offline.
This is not new to D7 and could have security implications, so I wouldn't be surprised if this has been brought up before, but a semi-thorough search did not find any previous issues about this.
| Comment | File | Size | Author |
|---|---|---|---|
| #29 | 722434-site-offline.patch | 5.32 KB | Garrett Albright |
| #27 | 722434-site-offline.patch | 5.32 KB | Garrett Albright |
| #25 | 722434-site-offline.patch | 5.38 KB | Garrett Albright |
| #22 | 722434-site-offline.patch | 5.4 KB | Garrett Albright |
| #19 | Screen shot 2010-09-06 at 3.51.42 PM.png | 43.48 KB | Garrett Albright |
Comments
Comment #1
jludwig commentedDrupal is supposed to work this way. This is so an administrator can log on to take the site off maintenance if they were logged off for whatever reason.
Comment #2
Garrett Albright commentedRight, but the only thing they need to log in is the log in form. Once they're logged in, then we can show them all the blocks and such. Frankly, your response doesn't really address the problem I posted about - that this feature allows for content we possibly don't want to be visible yet to be visible.
Comment #3
jludwig commentedYou're right, I apologize. I'll patch it up tonight.
Comment #4
jludwig commentedIt's actually somewhat complicated of a problems and I'll need all of you to vote on which solution you prefer... Patches coming soon.
Comment #5
seg108 commentedThis is bugging me too. I would prefer the main theme to be invisible if a user goes to ?q=user to log in when the site is in offline mode. Just a plain admin themed login block would be ideal when in offline maintenace. Maybe someone can suggest a simple way to do this for D6?
Comment #6
wxman commentedI've been trying to find a way around this too for D6.
I made custom maintenance-page.tpl.php, and maintenance-page-offline.tpl.php, and that helps. The user login form still bypasses it though. I poked around the documentation looking to see if maybe there's a php variable that get's set when in maintenance mode. If so maybe then a bit of php code could be added to the main page.tpl.php in your theme that bypasses the standard design, and goes to a "offline" design. Kind of like how the $page= flag is used.
Comment #7
Jeff Burnz commented@#6 - you can set your own variable, I had to do this on the weekend for D6 site and wrote a tutorial about it also because it was so annoyingly complicated to get done (not set the var, I mean the whole she-bang of theming the user login page when offline).
Comment #8
wxman commentedThank you. That's just what I was picturing.
Comment #9
heather commentedThis has become a thread about Drupal 6 work arounds.
Is this patch still being considered? Or should this go to D8?
Maintenance mode:
What you see at /user in maintenance mode
Comment #10
jludwig commentedSorry for holding this up for so long. I ended up getting busy/forgetting about this.
I'll write a something if it hasn't been done by the time I'm less busy.
I doubt it will get into Drupal 7, but we should definitely get it into Drupal 8.
Comment #11
heather commentedI think you're right, this is probably a D8 thing. In fact, this will likely roll into the numerous proposed changes to Maintenance mode. Though I'm wary of moving it out myself, heh.
Comment #12
Garrett Albright commentedPoppycock. This is arguably a security issue - and I'd be glad to be the one to argue that, inasmuch as it may be displaying information which a user isn't expecting to be displayed.
Here's a simple D7 patch which hides all blocks when in maintenance mode. I tried to do a similar thing for menus, and it looks similarly easy, but it's not happening - not yet sure if it's a caching thing or if menus are just loaded in a non-standard way when in maintenance mode and/or not logged in. Either way, this is a start.
heather seems to think that we should also be hiding the theme's logo and site name when in maintenance mode. I didn't consider that, but I think it makes sense. Currently, this patch does nothing to address it, though.
Comment #13
Jeff Burnz commentedNot sure about hiding the logo and sitename etc, many of my clients want this page branded.
Garrett -in what was is it a security issue, definitely a WTF I'd agree (as in why isn't maintenance page tpl used for all pages when in maintenance mode?)
Comment #14
Garrett Albright commentedIt's not necessarily a security issue, but it theoretically could be just because it doesn't behave how people may assume it to act - to make all parts of the site (save for the log in form) inaccessible to anonymous users when maintenance mode is enabled. So they could have sensitive info in a block or something like that.
Perhaps I was being bombastic to call it a security issue. Still, as it doesn't behave is one would expect, I think it qualifies as a bug which could be fixed in D7, even as a point release. If semaphores were fodder for a point release, at least this, something (probably) much less complicated, could be…
Comment #15
wxman commentedEven if it isn't a security issue, it's definitely a webmaster's sanity one. I have a site offline now, and I have to deal with people emailing, asking why they can't get to the parts of the menu they can see. For some reason the big notice saying the site's off line means nothing.
Comment #16
heather commentedWell, the patch works as required. RTBC from me, pending it getting tested.
Yet... I have this sneeking suspicion this is a feature request, and will be pushed to D8.
- h
Comment #17
Garrett Albright commentedI don't think it should go into the code until we find out how to hide menus too.
Comment #18
Garrett Albright commentedI've got it. Revert that previous patch - it's garbage. I went deep into the menu system for this one.
It's a bit tricky, because Drupal likes to use the same variable to hold page content as to hold an identifier which basically says "The site is offline." But we sort of need both; we need to identify the site as being offline (or, at least in this case, "semi-offline"), but still get the result of the menu callback which returns the user login forms and such. So what we're doing is kind of hacky, but hopefully not to the extent that we can't go ahead with getting this implemented for D7.
Haven't been able to run tests against this patch since enabling the Testing module seems to break SQLite sites at the moment (?), so let's see what the bots have to say. (Could probably use some more commentage as well.)
Comment #19
Garrett Albright commentedA screenshot to prove how awesome I am without having to apply the patch.
Comment #20
bojanz commentedLooks elegant.
The main debatable point here is the new menu constant. Moving this to the menu subsystem so that one of the maintainers can voice his opinion.
Comment #21
Anonymous (not verified) commentedReviewed the code. Applied the patch. Everything looks good and applied just fine.
Not marking as RTBC until the menu subsystem maintainers get a look at it.
Comment #22
Garrett Albright commentedA reroll:
Comment #23
Garrett Albright commentedGiven that the tests pass and that three reviewers have okayed the code (including chx via IRC, who is part of the menu system crew), I will be bold and move to RTBC pending objections or commission.
Comment #24
Jeff Burnz commentedwhitespace issues, tabs?
Thinking this comment needs a make-over...
I don't quite follow what this means?
Powered by Dreditor.
Comment #25
Garrett Albright commentedOops. Fixed.
Care to elaborate? Kept it the same for now.
Yeah… in retrospect, the test doesn't make a lot of sense. I've replaced it with one that should be more logical.
Comment #26
Jeff Burnz commentedSeems verbose and too passive. My rework of the comment in #24 is more active and succinct.
Comment #27
Garrett Albright commentedOhhh, I see what you did there. Okay.
Comment #28
Jeff Burnz commentedone white space
other than that RTBC, looks good and works as expected, great work Garrett.
Powered by Dreditor.
Comment #29
Garrett Albright commentedMan, how are you seeing those things?
Comment #31
Jeff Burnz commentedWith Dreditor - it will highlight them :)
#29: 722434-site-offline.patch queued for re-testing.
Comment #32
Garrett Albright commentedYa know, actually, my editor has a "trim trailing whitespace" feature… I just keep forgetting to use it. =[
Tests passed after re-queueing. Setting back to RTBC.
Comment #33
sunThis looks a bit odd to me.
1) Why not simply MENU_SITE_MAINTENANCE?
2) Why is no implementation of hook_menu_site_status_alter() not changed in this patch?
3) Not sure I understand why $page_callback_result is renamed to $offline_status in this patch?
Overall, I have the impression that this patch doesn't take all system components for this logic into account. At the very least, it requires in-depth reviews of base system maintainers.
Powered by Dreditor.
Comment #34
Garrett Albright commentedThat would be ambiguous with MENU_SITE_OFFLINE. In fact, I think the former is a more appropriate name for the latter, actually. chx suggested MENU_SITE_ONLINE_MAINTENANCE_TEMPLATE, and I went with that, slightly abbreviated.
The double negative is throwing me off… Are you asking me why the patch changes every implementation of hook_menu_site_status_alter()? If so, that's not the case - it only changes user.module's.
Because, in the unpatched code, $page_callback_result is awkwardly being used to store either a code specifying the reason for failure of a callback (403, 404, site offline) or the actual callback result. The patch splits this into two variables so that we can identify that a site is offline with one variable but still store the result of the callback in the other.
Okay. What's the best way to ask all of them to take a look at this patch?
Comment #35
LIQUID VISUAL commentedI was suprised to find that an entire "book" is viewable on the net, and listed in google, even though site is in maintenance mode. D7. http://cafelehibourecollections.ca
Comment #36
Millyfab commentedIs there now a solution in D7 to show only content variable, containing only the login form, without a patch ?
I mean, it seems obvious not to show other blocks and stuff at /user page while in offline mode...