We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 40088
    • 708 Posts
    I guess my question is if I put it in a snippet how do I run the generated login page through some sort of php validator, whether it's TextMate or something else? This is where a step-by-step is needed because I'm not getting my head around it. For such a simple login form I'm finding it surprising that it's so hard to troubleshoot.

    Thanks
      Todd
      • 3749
      • 24,544 Posts
      I haven't looked, but I was assuming that the PageLocker code does that for you. If not, you'd need to move stuff from the PageLocker template into the snippet (or a chunk pulled in with $modx->getChunk().



      ------------------------------------------------------------------------------------------
      PLEASE, PLEASE specify the version of MODX you are using.
      MODX info for everyone: http://bobsguides.com/modx.html
        Did I help you? Buy me a beer
        Get my Book: MODX:The Official Guide
        MODX info for everyone: http://bobsguides.com/modx.html
        My MODX Extras
        Bob's Guides is now hosted at A2 MODX Hosting
        • 3749
        • 24,544 Posts
        I'm working on fixing the plugin code.


        ------------------------------------------------------------------------------------------
        PLEASE, PLEASE specify the version of MODX you are using.
        MODX info for everyone: http://bobsguides.com/modx.html
          Did I help you? Buy me a beer
          Get my Book: MODX:The Official Guide
          MODX info for everyone: http://bobsguides.com/modx.html
          My MODX Extras
          Bob's Guides is now hosted at A2 MODX Hosting
          • 3749
          • 24,544 Posts
          I've been playing with the plugin and I may have fixed it. In addition to fixing the errors, I did some refactoring to (hopefully) make it safer and faster.

          Try this code in the plugin:

          <?php
          /**
           *
           * PageLocker
           *
           * Simple front-end password protection for individual or groups of pages.
           *
           * @ author Aaron Ladage (mods by Bob Ray)
           * @ version 1.1.0 - June 21, 2012
           *
           * PLUGIN PROPERTIES
           * &tvPassword - (Required) The TV for the password (default: 'pagePassword')
           * &tvPasswordGroup - The TV for the password group (default: 'pagePasswordGroup'). Not required, but a good idea, unless you want all password-protected pages to be accessible with the same password.
           * &formResourceID - (Required) The ID of the password form page (no default set, but absolutely necessary -- the plugin will not work without it)
           *
          **/
          
          /* @var $modx modX */
          /* @var $scriptProperties array */
          
          if (!function_exists("toForm")) {
              /* Show Login form */
              function toForm($resourceId) {
                  global $modx;
                  unset($_SESSION['password']);  // make sure password is not still set
                  if ($modx->resource->get('id') != $resourceId) { // prevent infinite loop
                      $modx->sendForward($resourceId);
                  }
              }
          }
          
          // Get the default plugin properties
          $tvPassword = $modx->getOption('tvPassword',$scriptProperties,'pagePassword');
          $tvPasswordGroup = $modx->getOption('tvPasswordGroup',$scriptProperties,'pagePasswordGroup');
          $formResourceID = $modx->getOption('formResourceID', $scriptProperties);
          
          
          // Get the password and password group values from the page's template variables
          $resourcePW = $modx->resource->getTVValue($tvPassword);
          $resourceGroup = $modx->resource->getTVValue($tvPasswordGroup);
          
          /* Do nothing if page is not password-protected, or the form page is not set in the properties */
          if ((empty($resourcePW)) || (empty($formResourceID))) { 
              return;
          }
          
          
            // Set additional defaults
          $resourceGroup = empty($resourceGroup) ? 0 : $resourceGroup;
          $groups = isset($_SESSION['groups'])? $modx->fromJSON($_SESSION['groups']) : array();
          /* Get and sanitize the password submitted by the user (if any) */
          $userPW = isset($_POST['password'])? filter_var($_POST['password'], FILTER_SANITIZE_STRING) : '';
          
          if (!empty($userPW)) { /* Form was submitted */
          
              if ($userPW == $resourcePW) { /* password matches the page's password */
                  /* Set the logged in and groups session */
                  $_SESSION['loggedin'] = 1;
                  if (! in_array($resourceGroup, $groups)) {
                      $groups[] = $resourceGroup;
                      $groupsJSON = $modx->toJSON($groups);
                      $_SESSION['groups'] = $groupsJSON;
                  }
          
                  return;
              } else { // Doesn't match. Back to the form!
                  toForm($formResourceID);      
              }
          }  else { // Form wasn't submitted, so check for logged in and groups sessions
              
              if ( empty($groups) || ! isset($_SESSION['loggedin']) || (! $_SESSION['loggedin'] === 1) || (! in_array($resourceGroup, $groups))) {
                  toForm($formResourceID);
            } 
          }




          Note that the Page you create with the PageLocker Template should be the *only* page using that Template. Set the ID of that page in the PageLocker Plugin Property (formResourceID).

          Be sure to connect the two PageLocker TVs to the Templates of any pages you want to protect.


          ------------------------------------------------------------------------------------------
          PLEASE, PLEASE specify the version of MODX you are using.
          MODX info for everyone: http://bobsguides.com/modx.html
            Did I help you? Buy me a beer
            Get my Book: MODX:The Official Guide
            MODX info for everyone: http://bobsguides.com/modx.html
            My MODX Extras
            Bob's Guides is now hosted at A2 MODX Hosting
            • 40088
            • 708 Posts
            Quote from: BobRay at Jul 24, 2012, 05:24 AM
            Note that the Page you create with the PageLocker Template should be the *only* page using that Template. Set the ID of that page in the PageLocker Plugin Property (formResourceID).

            Thanks for looking into it but it's still not working; same error. I'm wondering if it's something with my setup. Does it work for you? Locally?
              Todd
              • 3749
              • 24,544 Posts
              Yes, it works fine for me locally. Do you have the current version MODX?

              You may have to manually delete all files in the core/cache directory.

              Check the formResourceID property on the properties tab of the plugin. It should be set to ID of the resource that uses the PageLocker template. You need to create that resource and it may have to be published (but hidden from menus). No other resource should use that template.

              Also, make sure the two PageLocker TVs are attached to any templates of protected pages.


              ------------------------------------------------------------------------------------------
              PLEASE, PLEASE specify the version of MODX you are using.
              MODX info for everyone: http://bobsguides.com/modx.html
                Did I help you? Buy me a beer
                Get my Book: MODX:The Official Guide
                MODX info for everyone: http://bobsguides.com/modx.html
                My MODX Extras
                Bob's Guides is now hosted at A2 MODX Hosting
                • 40088
                • 708 Posts
                Quote from: BobRay at Jul 24, 2012, 06:59 AM
                You may have to manually delete all files in the core/cache directory.

                Yep, deleting the core/cache contents did the trick. Everything else you suggested was already in place. Nice work Bob, thank you. Out of curiosity, did you find errors in the original code? If so,what were they? And how did you make it safer?
                  Todd
                  • 3749
                  • 24,544 Posts
                  The original error was the line I cited earlier. If you had cleared the cache, that fix might have worked (unless I mistyped something).

                  As far as safer, I just added a little code to make sure some variables were cleared before re-displaying the form, and only display the form if not already on the form page. There was the potential for an infinite loop if you misconfigured PageLocker.

                  To be clear, there was never a security issue.

                  I also changed it to return right away for pages where it doesn't apply, to speed up page loads in general.

                  BTW, the author has released the new version so you can get it via Package Manager.


                  ------------------------------------------------------------------------------------------
                  PLEASE, PLEASE specify the version of MODX you are using.
                  MODX info for everyone: http://bobsguides.com/modx.html
                    Did I help you? Buy me a beer
                    Get my Book: MODX:The Official Guide
                    MODX info for everyone: http://bobsguides.com/modx.html
                    My MODX Extras
                    Bob's Guides is now hosted at A2 MODX Hosting
                    • 40088
                    • 708 Posts
                    Quote from: BobRay at Jul 25, 2012, 02:15 AM
                    BTW, the author has released the new version so you can get it via Package Manager.

                    Yes, I've been in touch with Aaron today. Thank you both.
                      Todd