This has bit me a couple times when I put a (usually testing) site into maintenance mode and then logged out and promptly forgot the user/1 password. Yes, I know I can reset it in MySQL, but that seems a little harsh. If there is no security risk, I would propose opening up user/password to anonymous users even when the site is in maintenance mode.

The biggest question, of course, is whether this is a security risk. I'd like to hear some opinions on this.

CommentFileSizeAuthor
#8 551880_password_reset_under_maintenance_with_tests.patch3.7 KBshawn dearmond
#4 551880_password_reset_under_maintenance_second_try.patch2.05 KBjim0203
#1 551880_password_reset_under_maintenance.patch2.05 KBshawn dearmond
#1 551880_maintenance_config_checkbox.png22.28 KBshawn dearmond

Comments

shawn dearmond’s picture

shawn dearmond commented
Status: Active » Needs review
StatusFileSize
new 551880_maintenance_config_checkbox.png22.28 KB
new 551880_password_reset_under_maintenance.patch2.05 KB

Here's a patch. I made this configurable by adding a checkbox to admin/config/development/maintenance, which defaults to off. (see attached screenshot.)

Status: Needs review » Needs work

The last submitted patch failed testing.

shawn dearmond’s picture

shawn dearmond commented
Status: Needs work » Needs review

bad bot? It succeeded before...

jim0203’s picture

jim0203 commented
StatusFileSize
new 551880_password_reset_under_maintenance_second_try.patch2.05 KB

Resubmitting the patch to see if the bot behaves itself.

chrishaslam’s picture

chrishaslam commented

This does indeed make much more sense than messing around with set pass=md5('NEWPASS') ;)

I applied the patch and tested the default (off) which works as expected like currently, going to /user/password when in maintenance still results in maintenance message.

I then enabled 'allow request new password' logged off and could successfully see the password request box as an anonymous user. I then reset my pass as anonymous and got the email with one-time link that worked as expected.

My only comment is this is obviously more useful for users who aren't technical or may not even have direct MySQL access. The downside for these (and new users of Drupal) is that the default is off, so without enabling this option they can still lock themselves out when in maintenance mode and being logged out.

shawn dearmond’s picture

shawn dearmond commented

I argue that it's generally wise to err on the side of security. Also, the behavior of Drupal in the past has always been to lock out the password request screen when in maintenance mode so that should probably be the default behavior. Since the user has to go to that screen in the first place to put the site in maintenance mode, the user will be given the choice at the appropriate time.

MichaelCole’s picture

MichaelCole commented

#4: 551880_password_reset_under_maintenance_second_try.patch queued for re-testing.

shawn dearmond’s picture

shawn dearmond commented
StatusFileSize
new 551880_password_reset_under_maintenance_with_tests.patch3.7 KB

Works great, as far as I can tell. Here's another re-rolled patch from today's HEAD. I also created some simpletests.

rfay’s picture

rfay
he,him
Primary language English
Location Palisade, CO, USA
commented
Status: Needs review » Closed (duplicate)

I'm pretty sure #363580: OpenID login fails when in maintenance mode is going to go in, and then that's going to be the way to solve this. See #363580-44: OpenID login fails when in maintenance mode for a summary.

Note that it doesn't currently allow /user/password when in maintenance mode, but if we want that feature then that will be the way to do it, with hook_login_paths().

shawn dearmond’s picture

shawn dearmond commented

Thanks for the link to that issue. Now that I see hook_login_paths(), it would be easy to build this in contrib. Maybe there should be something more like the "which pages should be available when in maintenance mode? All pages listed below, all pages EXCEPT those listed below, or use PHP to determine which pages" plus the standard textarea.

Now the hard part: coming up with a good namespace for a contrib module. I always hate this part.

rfay’s picture

rfay
he,him
Primary language English
Location Palisade, CO, USA
commented

I think that a followup after #363580: OpenID login fails when in maintenance mode goes in (assuming it does), perhaps in this issue might get your concern into core.

However, please mention on that issue how it solves the problem you're looking at. That's exactly the idea: To make this general problem easy to solve in contrib or wherever.