Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.
2 forngren:
Haven't found any occurences of "This Drupal site" string within Drupal core sources. So will use "Drupal" as site name.
2 drumm:
Try searching through user.module, a similar sentence there has no "and". Thus we can create a new issue for this that fixes any such occurences. What do you think? Also no explanations for uri_bried etc. procided there.
Not sure if this is a show-stopper or not, but I suspect it is. There is the following edge-case problem:
With the use of "@" in the token, you run up against accidental matches with email addresses. For example, if the site was called "Sitewise: A wise place", the "@site" in "Please contact dale@sitewise.com" would get matched and replaced, becoming "Please contact daleSitewise: A wise placewise.com".
Using the strtr function for string replacement does not allow escaping the "@" sign to prevent this.
I wonder if using "!" would be better, or perhaps the same format as the token module ([site], [uri], etc)?
If you want to stick with the "@" symbol I suggest a regex to check for whitespace/linebreak after the tokens. This isn't entirely ideal, since someone may want to use something like: Administrators can still log in at the <a href="@uri/user/login">site login page</a>
I agree with drumm in #6 but doq is correct, he's just following the example in admin/settings/user. Is this a case where admin/settings/user needs improving, or a case where this patch should follow the admin/settings/user example?
Message to show visitors when the site is in off-line mode. Available variables are [site], [uri], [uri_brief], [mailto], and [date]. uri_brief is uri without the preceeding "http://".
This is purely my opinion, so maybe don't reroll the patch without further feedback. I think you either explain all of the variables or none of the variables. Except for date, I don't think its safe to assume the user will understand any of the variables, so it seems strange to single out just one for explaining.
My vote would be for a terse version following the admin/settings/user example:
Message to show visitors when the site is in off-line mode. Available variables are [site], [uri], [uri_brief], [mailto], and [date].
If there is a strong desire to document the variables, this isn't the only page requiring it. And my vote would be creating a help page or emulating token module's method for displaying token explanations.
Make up your minds people. Whether it's ! or @ doesn't matter WRT string sanitation because strtr doesn't put @ through any cleaning.
@site is used in the first instance because it is processed by t(). @ was selected to sanitize the string. It's never seen by the end-user. t() is only possible there because it is a default value in case the maintenance variable somehow wasn't set when they put it into maintenance mode.
IOW, using @ doesn't bring any extra safety, which is why I added check_plain() separately.
I only used ! because you claimed "Rest of the web-site is using !token". It could be prefixed with **$^greenboogers for all I care.
#25 is missing the @site replacement for $site_offline_message.
I disagree with #28, but I don't do any translations for anything, so I'm not sure what impact lists have on the ordering of words in language - how that would work in islamic languages for example. I would imagine #27 is more flexible in that instance.
I was just looking how its done in user.admin.inc:
$form['email'] = array(
'#type' => 'vertical_tabs',
);
// These email tokens are shared for all settings, so just define
// the list once to help ensure they stay in sync.
$email_token_help = t('Available variables are:') . ' !username, !site, !password, !uri, !uri_brief, !mailto, !date, !login_uri, !edit_uri, !login_url, !cancel_url.';
Conversion of site maintenance settings to CMI made @site variable work for 8.x (https://drupal.org/node/1496458#comment-6284826).
Shouldn't we use @site style replacement variables for a seamless 7.x->8.x upgrade? I would like to hear what others think before setting the ball rolling again.
Tokens would be cool, but token path should go first in 8.x and @site would be a 7.x backport. Also, I'm not sure if tokens will be available in maintenance mode. I did a quick test in 7.x and they worked.
I did a quick test of comment #10. Some people may wish to display an email address on their maintenance mode screen and if the email address is example@sitewide.com it gets translated as suspected.
Reroll.
-Changed @site to [site:name] in default site maintenance message yml, having to single quote the string.
-Called token_replace after t(). Splitted lines in favor of readability.
-Added "This field supports tokens." to message description. The string is already present when #1308564: Basic token support in fields' help texts is commited. Will also be present in 7.x installs having the contrib 'token' module, if backported.
Updated tests to use the same default value for site maintenance message.
However, I still think we should remove the @site t() replacement handling entirely. Additionally, the entire usage of t() became bogus here in the first place, since a translation of the maintenance mode message needs to be handled by translatable config now.
Adjusted that in attached patch.
AFAICS, the maintenance mode seems to be broken during an upgrade path form D7 to D8 anyway already - the new code tries to read the configuration from config, but the configuration does not exist yet, so it's fairly clear that a site being upgraded to D8 will not show a maintenance mode page at all currently.
That's a preexisting issue though and not changed by this issue/patch. Therefore, I merely added a @todo to the existing update function.
To commiters:
This feature seems worth backporting to 7.x, but with the following considerations:
*No change to current default value, since it would break tranlations.
*No backporting for the update hook, same as above.
*Obviously, no CMI involved
*Others?
I'm not sure about this. What if you have your site in maintenance mode because you're updating something that the token API relies on. This is adding a fairly high-level dependency to that page which could end up breaking no?
The most obvious point I've found where things could break is at the module_invoke_all for getting tokens in token_generate(). In fact, it makes me wonder how tokens should be replaced in general while in maintenance mode. Should token_generate be restricted to module_invoking only system module tokens while in maintenance?
Is there anything else that could break?
Drupal 8.0.6 was released on April 6 and is the final bugfix release for the Drupal 8.0.x series. Drupal 8.0.x will not receive any further development aside from security fixes. Drupal 8.1.0-rc1 is now available and sites should prepare to update to 8.1.0.
Drupal 8.1.9 was released on September 7 and is the final bugfix release for the Drupal 8.1.x series. Drupal 8.1.x will not receive any further development aside from security fixes. Drupal 8.2.0-rc1 is now available and sites should prepare to upgrade to 8.2.0.
Drupal 8.2.6 was released on February 1, 2017 and is the final full bugfix release for the Drupal 8.2.x series. Drupal 8.2.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.3.0 on April 5, 2017. (Drupal 8.3.0-alpha1 is available for testing.)
Drupal 8.3.6 was released on August 2, 2017 and is the final full bugfix release for the Drupal 8.3.x series. Drupal 8.3.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.4.0 on October 4, 2017. (Drupal 8.4.0-alpha1 is available for testing.)
Drupal 8.4.4 was released on January 3, 2018 and is the final full bugfix release for the Drupal 8.4.x series. Drupal 8.4.x will not receive any further development aside from critical and security fixes. Sites should prepare to update to 8.5.0 on March 7, 2018. (Drupal 8.5.0-alpha1 is available for testing.)
Drupal 8.5.6 was released on August 1, 2018 and is the final bugfix release for the Drupal 8.5.x series. Drupal 8.5.x will not receive any further development aside from security fixes. Sites should prepare to update to 8.6.0 on September 5, 2018. (Drupal 8.6.0-rc1 is available for testing.)
Drupal 8.6.x will not receive any further development aside from security fixes. Bug reports should be targeted against the 8.8.x-dev branch from now on, and new development or disruptive changes should be targeted against the 8.9.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.
Drupal 8.8.7 was released on June 3, 2020 and is the final full bugfix release for the Drupal 8.8.x series. Drupal 8.8.x will not receive any further development aside from security fixes. Sites should prepare to update to Drupal 8.9.0 or Drupal 9.0.0 for ongoing support.
Drupal 9.3.15 was released on June 1st, 2022 and is the final full bugfix release for the Drupal 9.3.x series. Drupal 9.3.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.4.x-dev branch from now on, and new development or disruptive changes should be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.
Drupal 9.4.9 was released on December 7, 2022 and is the final full bugfix release for the Drupal 9.4.x series. Drupal 9.4.x will not receive any further development aside from security fixes. Drupal 9 bug reports should be targeted for the 9.5.x-dev branch from now on, and new development or disruptive changes should be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.
Thank you for sharing your idea for improving Drupal.
We are working to decide if this proposal meets the Criteria for evaluating proposed changes. There hasn't been any discussion here for over 8 years which suggests that this has either been implemented or there is no community support. Your thoughts on this will allow a decision to be made.
Since we need more information to move forward with this issue, the status is now Postponed (maintainer needs more info). If we don't receive additional information to help with the issue, it may be closed after three months.
Comments
Comment #1
RobRoy commentedWhy does this patch change @site to !site? Also, the usage of t() is a bit suspect, it should include all those vars and that space in one t() call.
Comment #2
doq commented!site is variable that changed to site name. It is all done as in user.module user mail texts.
Use of t() is OK and Drupal-friendly. Please, look for the same text (
t('Available variables are:')) in user.module.Comment #3
RobRoy commentedYou're right, the approach looks good and you're just reusing existing strings which makes sense. Haven't tested the patch though.
Comment #4
forngren commentedUpdated patch. Hope I didn't screw anything up.
Comment #5
doq commentedlooks better. Thanks.
Comment #6
drummThe UI needs to explain non-obvious concepts like 'uri brief.' Lists of items should have 'and' before the last item when we are writing English.
Comment #7
doq commented2 forngren:
Haven't found any occurences of "This Drupal site" string within Drupal core sources. So will use "Drupal" as site name.
2 drumm:
Try searching through user.module, a similar sentence there has no "and". Thus we can create a new issue for this that fixes any such occurences. What do you think? Also no explanations for uri_bried etc. procided there.
Enveloped new patch.
Comment #8
catchPatch no longer applies, bumping to D7.
Comment #9
deekayen commentedRolled again for D7, but with @ instead of ! and I combined the vars into the form description t() with "and" instead of breaking them out as a list.
Comment #10
dale42The patch works as advertised for me.
Not sure if this is a show-stopper or not, but I suspect it is. There is the following edge-case problem:
With the use of "@" in the token, you run up against accidental matches with email addresses. For example, if the site was called "Sitewise: A wise place", the "@site" in "Please contact dale@sitewise.com" would get matched and replaced, becoming "Please contact daleSitewise: A wise placewise.com".
Using the strtr function for string replacement does not allow escaping the "@" sign to prevent this.
I wonder if using "!" would be better, or perhaps the same format as the token module ([site], [uri], etc)?
If you want to stick with the "@" symbol I suggest a regex to check for whitespace/linebreak after the tokens. This isn't entirely ideal, since someone may want to use something like: Administrators can still log in at the <a href="@uri/user/login">site login page</a>
I agree with drumm in #6 but doq is correct, he's just following the example in admin/settings/user. Is this a case where admin/settings/user needs improving, or a case where this patch should follow the admin/settings/user example?
Comment #11
deekayen commentedThis version switches to the bracketed token module style, adds a sentence explaining uri_brief, and fixes code style on concats.
Comment #12
deekayen commented...and I left out a @ to [] change fixed here.
Comment #13
dale42Beauty, works as advertised.
Regarding the current help text:
Message to show visitors when the site is in off-line mode. Available variables are [site], [uri], [uri_brief], [mailto], and [date]. uri_brief is uri without the preceeding "http://".
This is purely my opinion, so maybe don't reroll the patch without further feedback. I think you either explain all of the variables or none of the variables. Except for date, I don't think its safe to assume the user will understand any of the variables, so it seems strange to single out just one for explaining.
My vote would be for a terse version following the admin/settings/user example:
Message to show visitors when the site is in off-line mode. Available variables are [site], [uri], [uri_brief], [mailto], and [date].
If there is a strong desire to document the variables, this isn't the only page requiring it. And my vote would be creating a help page or emulating token module's method for displaying token explanations.
Comment #15
deekayen commentedChanges to the terse description suggested in #13.
Comment #16
xmacinfoI asked bot to retest the last patch.
Comment #17
doq commentedConsider
'[date]' => format_date(REQUEST_TIME)
instead of
'[date]' => format_date(time())
Comment #18
deekayen commentedtime() replaced
Comment #19
deekayen commentedComment #21
doq commentedRest of the web-site is using !token instead of [token]. Is this ok to use [token] here?
Comment #22
doq commentedComment #23
deekayen commentedSwitches back to ! for tokens and updates for the new maintenance mode variable (the cause of previous apply failure).
Comment #24
doq commentedMore corrections:
1. preg_replace('!^https?://!', '', $base_url)
instead of
substr($base_url, strlen('http://'))
2. @variables instead if !variables.
3. Why there is both @site and !site used?
Comment #25
doq commentedComment #27
deekayen commentedMake up your minds people. Whether it's ! or @ doesn't matter WRT string sanitation because strtr doesn't put @ through any cleaning.
@site is used in the first instance because it is processed by t(). @ was selected to sanitize the string. It's never seen by the end-user. t() is only possible there because it is a default value in case the maintenance variable somehow wasn't set when they put it into maintenance mode.
IOW, using @ doesn't bring any extra safety, which is why I added check_plain() separately.
I only used ! because you claimed "Rest of the web-site is using !token". It could be prefixed with **$^greenboogers for all I care.
#25 is missing the @site replacement for $site_offline_message.
Comment #28
doq commentedStill t('Available variables are !site, !uri, !uri_brief, !mailto, and !date.') should be change like in #25, I think.
Comment #29
deekayen commentedI disagree with #28, but I don't do any translations for anything, so I'm not sure what impact lists have on the ordering of words in language - how that would work in islamic languages for example. I would imagine #27 is more flexible in that instance.
Comment #30
doq commentedI was just looking how its done in user.admin.inc:
so I think we should make the same.
Comment #31
doq commentedYes, probably in case of rtl language this would be a problem but we should create another issue for such case, I think. Thoughts?
Comment #32
deekayen commentedI say keep #27 and make an issue for #30.
Comment #33
doq commentedAgreed.
Comment #35
dale42doq, please see comment #10 (http://drupal.org/node/97650#comment-1710556). Using @ in this situation has a high probability of conflicts with regular text.
For what it's worth, the tokens used in the site email templates for welcome, account activation, password reset and other messages use !
Comment #36
dave reidBumping to D8. This should use the new Token API in core.
Comment #37
amonteroConversion of site maintenance settings to CMI made @site variable work for 8.x (https://drupal.org/node/1496458#comment-6284826).
Shouldn't we use @site style replacement variables for a seamless 7.x->8.x upgrade? I would like to hear what others think before setting the ball rolling again.
Tokens would be cool, but token path should go first in 8.x and @site would be a 7.x backport. Also, I'm not sure if tokens will be available in maintenance mode. I did a quick test in 7.x and they worked.
Comment #38
sunBetter title.
Comment #39
dave reidWe switch to using tokens by default, and provide support for running replacement of @site but without exposing it as an option to use.
Comment #40
stevesmename commentedI did a quick test of comment #10. Some people may wish to display an email address on their maintenance mode screen and if the email address is example@sitewide.com it gets translated as suspected.
Comment #41
amonteroReroll.
-Changed @site to [site:name] in default site maintenance message yml, having to single quote the string.
-Called token_replace after t(). Splitted lines in favor of readability.
-Added "This field supports tokens." to message description. The string is already present when #1308564: Basic token support in fields' help texts is commited. Will also be present in 7.x installs having the contrib 'token' module, if backported.
Updated tests to use the same default value for site maintenance message.
Comment #42
sunThis looks great.
Can't we update the maintenance_mode message very early in the update.php process? I'm not really happy with retaining the BC token @site for forever.
Comment #43
amontero#41: drupal--97650--token-support-for-site-maintenance-mode-message-41.patch queued for re-testing.
Comment #45
amonteroReroll
Comment #46
amonteroAdded system_update_8043 to address sun's comment in #42
Comment #47
sunThanks!
However, I still think we should remove the @site t() replacement handling entirely. Additionally, the entire usage of t() became bogus here in the first place, since a translation of the maintenance mode message needs to be handled by translatable config now.
Adjusted that in attached patch.
AFAICS, the maintenance mode seems to be broken during an upgrade path form D7 to D8 anyway already - the new code tries to read the configuration from config, but the configuration does not exist yet, so it's fairly clear that a site being upgraded to D8 will not show a maintenance mode page at all currently.
That's a preexisting issue though and not changed by this issue/patch. Therefore, I merely added a @todo to the existing update function.
Comment #49
amontero#47: maintenance.token_.47.patch queued for re-testing.
Comment #50
amonteroTested and works OK.
To commiters:
This feature seems worth backporting to 7.x, but with the following considerations:
*No change to current default value, since it would break tranlations.
*No backporting for the update hook, same as above.
*Obviously, no CMI involved
*Others?
Please advise.
Comment #51
catchI'm not sure about this. What if you have your site in maintenance mode because you're updating something that the token API relies on. This is adding a fairly high-level dependency to that page which could end up breaking no?
Comment #52
amonteroThe most obvious point I've found where things could break is at the module_invoke_all for getting tokens in token_generate(). In fact, it makes me wonder how tokens should be replaced in general while in maintenance mode. Should token_generate be restricted to module_invoking only system module tokens while in maintenance?
Is there anything else that could break?
Comment #53
thedavidmeister commentedI agree with #51 and #52, but I don't know how to restrict module invoking in the way suggested in #52.
Unless we can guarantee that tokens will work during maintenance mode, it might be worth going back to the approach in #27?
Comment #67
smustgrave commentedThank you for sharing your idea for improving Drupal.
We are working to decide if this proposal meets the Criteria for evaluating proposed changes. There hasn't been any discussion here for over 8 years which suggests that this has either been implemented or there is no community support. Your thoughts on this will allow a decision to be made.
Since we need more information to move forward with this issue, the status is now Postponed (maintainer needs more info). If we don't receive additional information to help with the issue, it may be closed after three months.
Thanks!
Comment #68
smustgrave commentedSince there's been no follow up in 3+ months going to close out. If someone still wants this feel free to re-open the ticket!