We would like to add an email field, and require users to input an email address along with the generic password. The idea is to check the email address against an ACL of authorised email addresses. Whilst not 'technically' more secure because an email address on the list would be easy to get hold if, it would deter casual sharing of the password.

Is there any chance of that being built by the maintainers? and if not, any hints about how to proceed?

We could use a flat file for the email address ACL, or db storage (which would really need to possibility of uploading, or pasting into a form, of a CSV of email addresses).

Comments

John_B created an issue. See original summary.

john_b’s picture

john_b commented
Issue summary: View changes
grimreaper’s picture

grimreaper
Primary language French
Location France 🇫🇷
commented

Hello John,

I am very busy this week, so I will only be able to see that this weekend (and maybe not even this weekend).

I don't know the ACL API, so I will need to see it.

To be sure to not confuse with something else. You are talking about the ACL module (https://www.drupal.org/project/acl)?

The list of addresses to check against is per node basis, per content type or global?

I think it will be stored in the database.

And as we are in a rc status, we will not add feature before a stable release will come out. We will only merge patches after the stable tag.

Thanks for your interest in the module.

john_b’s picture

john_b commented

Thanks for the reply.

ACL:

No I am not talking about the ACL module. 'ACL' is maybe a confusing term. By 'ACL' I mean a single arbitrary list of email addresses which could be uploaded, regardless of whether those email addresses belong to Drupal users. Anyone who enters an address on the list along with the password, will get access to any node which is protected by this module. The objective is to do something more lightweight than adding all the people with access to our nodes as full Drupal users. There would be a single list of email addresses for all nodes.

If there is a compelling reason to create Drupal user accounts for the people who have access, then we can. I prefer not to.

Background:

The site will host node with a link to a 'secure referrer URL'. This referrer URL will allow anyone who can access it to be redirected to a paid database on a third-party site. The thinking is that if each user must enter an email address as well as a generic password, they will hesitate about sharing their login details with their students, or posting it on Facebook. Access will probably not be tracked, so the extra security will not keep out serious hackers. It may discourage people from sharing the password if they must also share an email which is on the list.

grimreaper’s picture

grimreaper
Primary language French
Location France 🇫🇷
commented

Hello John_B,

I don't think we will add this feature on protected node as it seems very specific.

But I think you can easily implement a custom module for your needs.

To store your email addresses, if it is a small number, in a variable. If not, in a custom table.

For the form, you can alter the protected_node form in your module to add an email address field and add your validation callback that will check the address against your addresses.

For uploading the addresses, a basic BO form with file upload then treatment.

That's what I would have done. But we can't add a submodule like that because it will be incompatible with future submodules like OG integration that I think will be more global.

john_b’s picture

john_b commented
Status: Active » Closed (won't fix)

Thank you. Marking as Closed (won't fix).

grimreaper’s picture

grimreaper
Primary language French
Location France 🇫🇷
commented

As said in private conversation.

If you encounter problem or need some info. Do not hesitate to ask in this issue and to post your code.