Hot answers tagged

17

I've actually done this a couple of times... a very simple "password-only" page. Then there would be a large group of people who share that same password, and can gain access to that protected page. Disclaimer: This example was built using the Business Logic plugin template. There are many ways to manage your password, but it sounds like you'll want ...


16

Check out the autoLoginAfterAccountActivation config setting. To enable it, set it to true in your craft/config/general.php file: 'autoLoginAfterAccountActivation' => true


11

First – your Twig syntax is a little off. Here's how you could add the current URL/request path to a link, as a query parameter p: <a href="members/login?p={{ craft.request.path }}">Log in</a> Notice that the syntax/tag for printing a value/variable is {{ value }}, not {% value %}. Second, since the redirect in this case should happen when the ...


10

Most likely wherever Apache/PHP is configured to save session files doesn't exist or isn't writable. If you've got the overridePhpSessionLocation config setting set to true, then that will be in craft/storage/runtime/sessions folder.


10

The easiest way I have found to password protect page content is as follows: {% if craft.request.getParam('password') == 'password_you_want' %} <h2>This is your content</h2> {% else %} <h2>Not authorized</h2> <form action="{{ craft.request.getUrl() }}" method="POST" accept-charset="utf-8" class="form-inline"> ...


7

I want to be able that users can enter their emailaddress in an input and that the activation link gets resend You'll need to write a plugin, which can generate activation URLs using the UsersService: echo craft()->users->getPasswordResetUrl($user); If you want to send the user an activation email instead of echoing a link in the frontend, you can ...


6

If you are using {% requireLogin %} tags, then the Craft UserSession service has a getReturnUrl() method which should give you what you want. It is accessible in your templates via craft.session.returnUrl. Here is a link to the docs. Hope this helps!


6

What server provisioner are you using? Forge? Something else? If it's Forge, it's most likely this: https://twitter.com/nystudio107/status/895726366477344772 Also here are some Nginx configs (with Forge examples) that are known to work with Craft CMS 2.x and 3.x: Nginx-Craft


5

This could be a couple things: Server config .htaccess file SSL Certificate But it sounds to me like the insecure login button means those assets are not being served over SSL. How'd you confirm the site is served over https? Craft's control panel resources are not actually in the document root so what's happening is Craft's controller (index.php) is ...


5

This probably works: craft.users.status('suspended').lastLoginDate(':empty:')


5

Go to the Users section of the Control Panel (mysite.com/admin/users/). Click on the user account that needs to be activated. Click on the settings cog on the right side (see attached image), and choose which option works for you. Hope this helps!


5

Good call Brad! Not sure why that didn't occur to me :) Here's how that's done: # Kill admin access RewriteCond %{REQUEST_URI} ^(.*)/admin RewriteRule ^(.*)$ - [F,L]


5

You can call it from the front-end, but it requires the currently logged in user to be an administrator. Just point the form's hidden action input to users/impersonate and have it submit a 'userId' input of the person you want to log in as.


5

There are several config settings which should help... maxInvalidLogins - The number of invalid login attempts Craft will allow within the specified duration before the account gets locked. invalidLoginWindowDuration - The amount of time to track invalid login attempts for a user, for determining if Craft should lock an account. cooldownDuration - The ...


5

So I looked into this a bunch more tonight to satisfy my curiosity, and here's what is happening. The default rewrite rule that Forge is apparently adding is this: if ($request_uri ~* "^(.*/)index\.php/?(.*)") { return 301 "$1$2"; } What this does is essentially it just removes index.php from URLs, which seems harmless enough. On the login screen, ...


4

You can set a variable in your craft/config/general.php. Here is the option taken from the default config file which is located here craft/app/etc/config/defaults/general.php: Updated: /** * The path that users should be redirected to after logging in from the front-end site. * * This setting will also come into effect if the user visits the Login page (...


4

The verificationCodeDuration config setting is what you're looking for. Defaults to 24 hours.


4

Is there a 2-factor authentication plugin for Craft? I've heard of one in private testing, but I'm not aware if they plan to release it publicly or not. Until the official Craft plugin store becomes a thing, the most comprehensive list of Craft plugins available I know of is over on the awesome Straight Up Craft. I want to build a system that someone on ...


4

You can use "incognito mode" in your browser, or you use another browser or computer for this type of front end testing.


4

There are so many tables that phpMyAdmin paginates them. All the tables that came after craft_tags alphabetically are on the second page, making it look like there is no craft_users table. Pagination controls are at the top: Reason I know? I just made the same mistake.


4

This is not actually my answer since it's from Andrew Welch on Twitter here: https://mobile.twitter.com/nystudio107/status/1063135843441954816 If you have access to MySQL, you can change the admin user password to secret using this hash: $2y$13$FfVKvo1W1N5Gsba3c19r8uz.x9R5NRQgRu8jmXvOjVCStg1sKGcoW


3

Couldn't you set the password to a variable on the login page if it is the correct intranet url? {% if craft.request.getUrl() == "intranet.net" %} {% set pass = "password" %} {% endif %} <input type="password" value="{{ pass|default('') }} name="password" />


3

I’ve done this a few times before and this is how I usually get it done. Set Per Entry Password Within Craft create a new Plain Text field for the entry you would like password protected. The password for the entry can be a phrase, random string of numbers and letters, whatever. Create a Login Template In Craft, set up a route to the login template ...


3

That is set by the loginPath config setting so yes, you can change it in your craft/config/general.php file. There are a few other configurable URLs for templates and redirects, all of which are described on that page.


3

If you’re getting the {success: true} response, then the user is getting logged in successfully, and the cookie would have actually been created by that response.


3

Nothing native in Craft that would do this, but I suppose you'd be able to .htaccess redirect all requests to your cpTrigger.


3

I believe you're looking for the aptly named autoLoginAfterAccountActivation config setting.


3

What you're attempting to do is very doable. This should be of help to you: https://craftcms.com/classreference/services/UsersService You can use the Yii forward function to pass along a request to another action handler: $this->forward('users/sendNewEmailVerifyEmail', false);


3

Is the physical web server inside your network as well? As mcclaskiem mentioned, check to see if the IP address is within the subnet of your network and then allow access that way. You may want to have the web server listen on another hostname that's not accessible outside the network and allow access to that vhost unconditionally (but do that at the ...


3

Sounds like a custom plugin is in order. Your plugin could add a custom {% validateUser %} Twig tag. That tag would check to see if their logged in OR check craft.request.getIpAddress() and validate against your internal IP whitelist for your company. You should read the notes on that link, though, since this isn't guaranteed to be secure. It's trivial to ...


Only top voted, non community-wiki answers of a minimum length are eligible