I'm using the Boost module on a site and I recently implemented your module. It works ok the first time, but if your using the boost module, it will cache the page after the password is entered and bypass the security. See: http://drupal.org/node/328143#comment-3681320

After adding the protected page's url to Boost's exclusions list, the protected node module worked as intended.

I suggest adding this to your documentation, or adding logic to detect the boost module and automatically add exclusions when i page is set to be protected.

Comments

AlexisWilke’s picture

AlexisWilke commented
Category: feature » bug

devkinetic,

There is a function for that purpose. I also use boost. If it doesn't work right, then we need to fix the function (current version shown below.)

Could you please try with 6.x-1.6-beta3 to see whether the problem persists.

Thank you.
Alexis

/**
 * Prevent boost from caching protected nodes.
 *
 * @todo
 * We also need to make sure the cache gets cleared whenever
 * the protection is turned on.
 */
function protected_node_boost_is_cacheable($path) {
  // the $path may be an alias, unalias first
  $url = drupal_lookup_path('source', $path);
  if (!$url) {
    // $path is not an alias, use $path as is for our test
    $url = $path;
  }
  $p = explode('/', $url);
  if (count($p) == 2 && $p[0] == 'node' && is_numeric($p[1])) {
    // if protected, do not cache (i.e. not caching == return FALSE)
    return !protected_node_isset_protected($p[1]);
  }
}
AlexisWilke’s picture

AlexisWilke commented
Status: Active » Closed (cannot reproduce)

No response, it either works or was abandoned.

Thank you.
Alexis

devkinetic’s picture

devkinetic commented

Hi Alexis,

I actually had to abandon the module due to the cookie issue, as a few of the clients who would be using the protected nodes had them disabled, unfortunate...

Your code does look acceptable though. I do know I had to add both the /protected-node page itself, as well as the node with protection to my exemptions, not sure if that helps anymore.

AlexisWilke’s picture

AlexisWilke commented

At some point I may find the time to add a URL capability that does not require a cookie... but that would not be as secure (i.e. that URL could be used by anyone to see the page without password.)

The cache on the /protected-node page should have been reset automatically whenever you post the message. This being said, I'm not 100% sure that's the case. And I think it can be a problem if you have two people viewing the page and then submitting the password. One of them would fail.

On the other hand, I did not have any problem on my end and I'm using boost...

We'll see if someone else reports a problem. 8-)

Thank you for the extra info.
Alexis Wilke