[docs] password_protect

uli · 2014-11-14 17:05:35

Inspired by this topic I’m exploring the password_protect tag (only tried in a drive-by modus, years ago) and had a look at it’s documentation that’s looking sparse at the moment. I wanted to change that a little but come back with lots of questions on the tag, instead:

The login name can be changed adminside. After logging in once it seems I can visit the page regardless of such login changes. Does that make any sense?
Can the login be revoked at all by an admin? How?
How long is it valid user-side after entering the name/PW combo?
Where are the entries stored user-side, doesn’t look like it’s a cookie.
Field entries seem arbitrary, i.e. independent from the site’s user base. Can someone confirm that, please? (Can’t test because of point 1.)
Is it possible to have several users login under different names with different PWs? (i.e. comma separated lists. Can’t test because of point 1.)

Last edited by uli (2014-11-14 17:21:09)

etc · 2014-11-14 21:04:07

Hi Uli,

I’ll try to reply, please anybody correct anything wrong.

There is absolutely no relation between txp users and login/pass attributes of <txp:password_protect />. Does it answer your question?
There is no login created by <txp:password_protect />, it suffices to modify/delete the tag.
Browser-dependent, from 15 min to session.
HTTP Athorization header.
See 1.
Again, they are not txp logins. The tag just checks if the visitor has entered the right attributes values. If you have two pages on the same domain with different <txp:password_protect /> attributes, you will have to enter them every time you switch between these pages.

uli · 2014-11-16 18:00:52

Hi Oleg,

thanks for your in depth reply.
I’ve not written my annotations with all the care it requires, sorry. With this here …

The login name can be changed adminside.

… I meant: I can change the attribute values of the tag.

And though I did so I still had access to the test page. So this might be the duration you spoke of in #3. If, however, the access to the page can’t be definitely controlled by the admin of the website because it is browser dependent (and there may be computers out there running over weeks without having a shut down), then I would not recommend using the password_protect tag. But perhaps I’m doing something unusual with it (dropped it in an article body) or (hopefully) my conclusions are wrong.

EDIT: Tests following couldn’t harden my awry experiences, the tag seemed to work as announced, so I could strike that sentence above.

Last edited by uli (2015-01-11 15:12:28)

etc · 2014-11-16 21:32:40

uli wrote #285798:

… I meant: I can change the attribute values of the tag.

And though I did so I still had access to the test page.

Not in my tests, that’s what made me think you are speaking about txp logins. It needs confirmation, but, anyhow, <txp:password_protect /> will not protect an article from appearing in search results, for example.

uli · 2015-01-11 15:08:55

Just saw this one is still unanswered although I finally succeeded in making the tag work several weeks ago. Sorry for not remembering to come back here.

As I’ve once had password_protect also blocking me from opening a list page–which it didn’t last time–and with me being a little averse to the tag considering my varying experiences with it, I think I’m not the right person for writing a reliable extension of the tag’s documentation, sorry.

Textpattern CMS

Textpattern CMS support forum

#1 2014-11-14 17:05:35

[docs] password_protect

#2 2014-11-14 21:04:07

Re: [docs] password_protect

#3 2014-11-16 18:00:52

Re: [docs] password_protect

#4 2014-11-16 21:32:40

Re: [docs] password_protect

uli wrote #285798:

#5 2015-01-11 15:08:55

Re: [docs] password_protect

Board footer