Stop me if you've heard this one before…

If you have a site and you don't want anyone to see it for a while for whatever reason, you may solve that problem by taking it offline. So you put it into maintenance mode. Problem solved, right? People that aren't logged in see the "down for maintenance" message and nothing else, so they can go about their day.

…Except for the /user page, which shows the user login page exactly as it would if the site were not offline. Same menus, same blocks, etc. And if those menus and/or blocks contain or imply the same stuff that you're trying to hide and therefore took the site offline for in the first place… well, it defeats the purpose, doesn't it?

The proposed solution is for the /user page to contain only the user login form with no blocks, menus, etc just like the "down for maintenance" page when the site is offline.

This is not new to D7 and could have security implications, so I wouldn't be surprised if this has been brought up before, but a semi-thorough search did not find any previous issues about this.

Comments

jludwig’s picture

Status: Active » Closed (works as designed)

Drupal is supposed to work this way. This is so an administrator can log on to take the site off maintenance if they were logged off for whatever reason.

Garrett Albright’s picture

Status: Active » Closed (works as designed)

Right, but the only thing they need to log in is the log in form. Once they're logged in, then we can show them all the blocks and such. Frankly, your response doesn't really address the problem I posted about - that this feature allows for content we possibly don't want to be visible yet to be visible.

jludwig’s picture

Status: Closed (works as designed) » Active

You're right, I apologize. I'll patch it up tonight.

jludwig’s picture

Assigned: Unassigned » jludwig
Status: Closed (works as designed) » Active

It's actually somewhat complicated of a problems and I'll need all of you to vote on which solution you prefer... Patches coming soon.

seg108’s picture

This is bugging me too. I would prefer the main theme to be invisible if a user goes to ?q=user to log in when the site is in offline mode. Just a plain admin themed login block would be ideal when in offline maintenace. Maybe someone can suggest a simple way to do this for D6?

wxman’s picture

I've been trying to find a way around this too for D6.
I made custom maintenance-page.tpl.php, and maintenance-page-offline.tpl.php, and that helps. The user login form still bypasses it though. I poked around the documentation looking to see if maybe there's a php variable that get's set when in maintenance mode. If so maybe then a bit of php code could be added to the main page.tpl.php in your theme that bypasses the standard design, and goes to a "offline" design. Kind of like how the $page= flag is used.

Jeff Burnz’s picture

@#6 - you can set your own variable, I had to do this on the weekend for D6 site and wrote a tutorial about it also because it was so annoyingly complicated to get done (not set the var, I mean the whole she-bang of theming the user login page when offline).

function template_preprocess(&$vars, $hook) {
  $vars['in_maintenance'] = MAINTENANCE_MODE;
}
wxman’s picture

Thank you. That's just what I was picturing.

heather’s picture

This has become a thread about Drupal 6 work arounds.

Is this patch still being considered? Or should this go to D8?

Maintenance mode:

Only local images are allowed.

What you see at /user in maintenance mode

Only local images are allowed.

jludwig’s picture

Assigned: jludwig » Unassigned

Sorry for holding this up for so long. I ended up getting busy/forgetting about this.

I'll write a something if it hasn't been done by the time I'm less busy.

I doubt it will get into Drupal 7, but we should definitely get it into Drupal 8.

heather’s picture

I think you're right, this is probably a D8 thing. In fact, this will likely roll into the numerous proposed changes to Maintenance mode. Though I'm wary of moving it out myself, heh.

Garrett Albright’s picture

StatusFileSize
new764 bytes

Poppycock. This is arguably a security issue - and I'd be glad to be the one to argue that, inasmuch as it may be displaying information which a user isn't expecting to be displayed.

Here's a simple D7 patch which hides all blocks when in maintenance mode. I tried to do a similar thing for menus, and it looks similarly easy, but it's not happening - not yet sure if it's a caching thing or if menus are just loaded in a non-standard way when in maintenance mode and/or not logged in. Either way, this is a start.

heather seems to think that we should also be hiding the theme's logo and site name when in maintenance mode. I didn't consider that, but I think it makes sense. Currently, this patch does nothing to address it, though.

Jeff Burnz’s picture

Not sure about hiding the logo and sitename etc, many of my clients want this page branded.

Garrett -in what was is it a security issue, definitely a WTF I'd agree (as in why isn't maintenance page tpl used for all pages when in maintenance mode?)

Garrett Albright’s picture

It's not necessarily a security issue, but it theoretically could be just because it doesn't behave how people may assume it to act - to make all parts of the site (save for the log in form) inaccessible to anonymous users when maintenance mode is enabled. So they could have sensitive info in a block or something like that.

Perhaps I was being bombastic to call it a security issue. Still, as it doesn't behave is one would expect, I think it qualifies as a bug which could be fixed in D7, even as a point release. If semaphores were fodder for a point release, at least this, something (probably) much less complicated, could be…

wxman’s picture

Even if it isn't a security issue, it's definitely a webmaster's sanity one. I have a site offline now, and I have to deal with people emailing, asking why they can't get to the parts of the menu they can see. For some reason the big notice saying the site's off line means nothing.

heather’s picture

Status: Active » Needs review

Well, the patch works as required. RTBC from me, pending it getting tested.

Yet... I have this sneeking suspicion this is a feature request, and will be pushed to D8.

- h

Garrett Albright’s picture

Status: Needs review » Active

I don't think it should go into the code until we find out how to hide menus too.

Garrett Albright’s picture

Status: Active » Needs review
StatusFileSize
new3.69 KB

I've got it. Revert that previous patch - it's garbage. I went deep into the menu system for this one.

It's a bit tricky, because Drupal likes to use the same variable to hold page content as to hold an identifier which basically says "The site is offline." But we sort of need both; we need to identify the site as being offline (or, at least in this case, "semi-offline"), but still get the result of the menu callback which returns the user login forms and such. So what we're doing is kind of hacky, but hopefully not to the extent that we can't go ahead with getting this implemented for D7.

Haven't been able to run tests against this patch since enabling the Testing module seems to break SQLite sites at the moment (?), so let's see what the bots have to say. (Could probably use some more commentage as well.)

Garrett Albright’s picture

StatusFileSize
new43.48 KB

A screenshot to prove how awesome I am without having to apply the patch.

bojanz’s picture

Component: base system » menu system

Looks elegant.
The main debatable point here is the new menu constant. Moving this to the menu subsystem so that one of the maintainers can voice his opinion.

Anonymous’s picture

Reviewed the code. Applied the patch. Everything looks good and applied just fine.

Not marking as RTBC until the menu subsystem maintainers get a look at it.

Garrett Albright’s picture

StatusFileSize
new5.4 KB

A reroll:

  • chx hated the name of the new constant, so I changed it to something a little more self-documenting.
  • More comments.
  • A test! …which I still can't run on my system. So let's see.
Garrett Albright’s picture

Status: Needs review » Reviewed & tested by the community

Given that the tests pass and that three reviewers have okayed the code (including chx via IRC, who is part of the menu system crew), I will be bold and move to RTBC pending objections or commission.

Jeff Burnz’s picture

Status: Reviewed & tested by the community » Needs work
+++ modules/simpletest/tests/menu.test	10 Sep 2010 03:12:29 -0000
@@ -82,6 +82,12 @@ class MenuRouterTestCase extends DrupalW
+    ¶
+    // Assure that the user login and password reset pages are using the
+    // maintenance theme too (in Drupal 6, the main site theme was used). The
+    // presence of the form itself is tested in modules/system/system.test.
+    $this->drupalGet('user/login');
+    $this->assertRaw('bartik/css/style.css', t("The maintenance theme's CSS appears on the page."));    ¶

whitespace issues, tabs?

// Assure that the user login and password reset pages use the
// maintenance theme. The presence of the form is tested in 
// modules/system/system.test.

Thinking this comment needs a make-over...

The maintenance theme's CSS appears on the page.

I don't quite follow what this means?

Powered by Dreditor.

Garrett Albright’s picture

Status: Needs work » Needs review
StatusFileSize
new5.38 KB

whitespace issues, tabs?

Oops. Fixed.

Thinking this comment needs a make-over...

Care to elaborate? Kept it the same for now.

I don't quite follow what this means?

Yeah… in retrospect, the test doesn't make a lot of sense. I've replaced it with one that should be more logical.

Jeff Burnz’s picture

Seems verbose and too passive. My rework of the comment in #24 is more active and succinct.

Garrett Albright’s picture

StatusFileSize
new5.32 KB

Ohhh, I see what you did there. Okay.

Jeff Burnz’s picture

+++ modules/simpletest/tests/menu.test	15 Sep 2010 17:21:13 -0000
@@ -83,6 +83,12 @@ class MenuRouterTestCase extends DrupalW
+    // maintenance theme. The presence of the form is tested in ¶

one white space

other than that RTBC, looks good and works as expected, great work Garrett.

Powered by Dreditor.

Garrett Albright’s picture

Status: Needs review » Reviewed & tested by the community
StatusFileSize
new5.32 KB

Man, how are you seeing those things?

Status: Reviewed & tested by the community » Needs work

The last submitted patch, 722434-site-offline.patch, failed testing.

Jeff Burnz’s picture

Status: Needs work » Needs review

With Dreditor - it will highlight them :)

#29: 722434-site-offline.patch queued for re-testing.

Garrett Albright’s picture

Status: Needs review » Reviewed & tested by the community

Ya know, actually, my editor has a "trim trailing whitespace" feature… I just keep forgetting to use it. =[

Tests passed after re-queueing. Setting back to RTBC.

sun’s picture

Status: Reviewed & tested by the community » Needs work
+++ includes/menu.inc	16 Sep 2010 02:43:00 -0000
@@ -244,6 +244,14 @@ define('MENU_SITE_OFFLINE', 4);
 /**
+ * Internal menu status code -- Site is offline, but show this content using the
+ * "maintenance" page template anyway. Useful for showing the user login and
+ * password retrieval forms while the site is in maintenance mode, but not
+ * showing any other page content besides that (such as sidebar content, etc).
+ */
+define('MENU_SITE_ONLINE_MAINTENANCE_TPL', 6);

This looks a bit odd to me.

1) Why not simply MENU_SITE_MAINTENANCE?

2) Why is no implementation of hook_menu_site_status_alter() not changed in this patch?

3) Not sure I understand why $page_callback_result is renamed to $offline_status in this patch?

Overall, I have the impression that this patch doesn't take all system components for this logic into account. At the very least, it requires in-depth reviews of base system maintainers.

Powered by Dreditor.

Garrett Albright’s picture

1) Why not simply MENU_SITE_MAINTENANCE?

That would be ambiguous with MENU_SITE_OFFLINE. In fact, I think the former is a more appropriate name for the latter, actually. chx suggested MENU_SITE_ONLINE_MAINTENANCE_TEMPLATE, and I went with that, slightly abbreviated.

2) Why is no implementation of hook_menu_site_status_alter() not changed in this patch?

The double negative is throwing me off… Are you asking me why the patch changes every implementation of hook_menu_site_status_alter()? If so, that's not the case - it only changes user.module's.

3) Not sure I understand why $page_callback_result is renamed to $offline_status in this patch?

Because, in the unpatched code, $page_callback_result is awkwardly being used to store either a code specifying the reason for failure of a callback (403, 404, site offline) or the actual callback result. The patch splits this into two variables so that we can identify that a site is offline with one variable but still store the result of the callback in the other.

Overall, I have the impression that this patch doesn't take all system components for this logic into account. At the very least, it requires in-depth reviews of base system maintainers.

Okay. What's the best way to ask all of them to take a look at this patch?

LIQUID VISUAL’s picture

I was suprised to find that an entire "book" is viewable on the net, and listed in google, even though site is in maintenance mode. D7. http://cafelehibourecollections.ca

Millyfab’s picture

Is there now a solution in D7 to show only content variable, containing only the login form, without a patch ?
I mean, it seems obvious not to show other blocks and stuff at /user page while in offline mode...

Status: Needs work » Closed (outdated)

Automatically closed because Drupal 7 security and bugfix support has ended as of 5 January 2025. If the issue verifiably applies to later versions, please reopen with details and update the version.