Recent Topics

1 Dec 24, 2009 12:25    

My b2evolution Version: 3.3.1

After combing through the forums[1] and official documentation[3] trying to figure out how "protected" pages are supposed to work, and not finding a solution or good explanation, I'll contribute to the noise and hope that perhaps a better description will filter out here! The site is at carymathews.info.

My goal is to post protected (personal) information (resume/CV, school transcripts, etc.) within a b2evolution blog. I don't want the general public to have access to this information, but would like to generate temporary (30-, 60-, or 90-day duration) username/passwords to distribute as needed. The recipients would be able to use those username/passwords to authenticate to b2evolution and then see the protected information. However, I do not want these users to be able to modify any data.

The steps I've taken so far are to create a new user group "Readers" and to select the "No Access" to the Admin area radio button under the user permissions screen. I've created a user as a member of the "Readers" group, "Joe". Under the "Blog Settings" -> Features Tab, I've enabled "Use Advanced Permissions", to allow me to customize the access permissions for the "Readers" group and members of that group.

Under the Blog settings -> "Users" tab, I've chosen the "Advanced" layout which allows me to customize individual permissions for groups. Here I've selected "Is Member" and "Publ" (Permission to read Protected Posts") to allow members of the "Readers" group to read posts saved as "protected". After selecting the "Update" button at the bottom of that page to save the selected settings, I've created a page[2] (title: "Resume") and saved it as protected.

When I access the site as a anonymous browser, my protected page does not show up -- which is the expected behavior. After clicking on the "Log in" link provided, and using the username & password set up for "Joe" above, I get redirected to the frontpage, but the protected page still does not show -- which is the unexpected behavior.

After completing the above steps, what am I missing? I'm not afraid to start wading through PHP code, but since this is supposed to be advertised behavior, I wanted to make sure I completed all the proper & supported steps first.

Thanks in advance!

[1] Lots of discussions have covered this topic:
http://forums.b2evolution.net/viewtopic.php?t=15215 -- how to make use of post statuses (Draft, Protected, etc.)
http://forums.b2evolution.net/viewtopic.php?t=19868 -- limiting access to a specific set of users not working
http://forums.b2evolution.net/viewtopic.php?t=19109 -- The "Publish Now" button overrides the "Protected" radio button
http://forums.b2evolution.net/viewtopic.php?t=13788 -- howto keep web spiders from indexing particular blogs in a multi-blog configuration
http://forums.b2evolution.net/viewtopic.php?t=19848 -- request to fine-tune user access
http://forums.b2evolution.net/viewtopic.php?t=19976 -- how to turn on adv. group/user permissions
http://forums.b2evolution.net/viewtopic.php?t=17485 -- howto require all users to login prior to viewing blog
¥åßßå has at least twice referred people to the site http://b2evo-archived.waffleson.co.uk/2008/12/protect-your-blogs/ which states:

It's dead simple really, first go grab the plugin from BOPIT, unzip it, upload it, meander into admin and install it .... that was the hard part. For any blog that you wish to protect just put am:protected in the blog notes field and press save ...... and that's it! Instant protected blog ;)

but the plugin to grab is not named or linked to directly -- users have to install the BOPIT plugin first and then know that the title of his post ("Protect your blogs") is the name of the plugin. But this raises the question, do users need a plugin to accomplish something that the blog (supposedly) already has built in?

[2] I understand the distinction between posts and pages, and intentionally want to protect a Page in this manner. If "protection" applies only to posts and not pages, this should probably be documented somewhere and/or the "protected" option not be available when creating pages.

[3] From the Manual:
http://manual.b2evolution.net/Users_Groups_tab
http://manual.b2evolution.net/User_groups -- default group settings
http://manual.b2evolution.net/Users_%26_Groups_tab -- empty (URL encoding problems? "Users_&_Groups_tab")
http://manual.b2evolution.net/New_users -- howto create new users

EDIT: added additional forum discussions on protected pages, descriptions of discussions, and minor formatting changes.
EDIT: added links to relevant pages of the b2evolution Manual

2 Dec 24, 2009 19:13

1) the blog post I linked to was from a tad ago, long before I archived my site ... but the plugins name in bopit is "protect your blog" ... I'm kinda unimaginative when it comes to names ... but it isn't the solution to your problems ;)

2) then you'll understand that pages don't "appear" unless you call them by url? [permalink] they don't "appear" in your normal blog flow ( they're not "posts" )

¥

3 Dec 24, 2009 21:05

¥åßßå,

Thank you for saying that explicitly. so how to get pages to appear? The "Simple Page List" widget will create a list of existing pages with appropriate HTML links to call each by their permalink URL. If I didn't want ALL my pages to show up in this list, I can use the "Free HTML" widget to add just the specific permalink URLs I want. Since I had not completed that step prior to posting, I have remedied and completed it now.

Now, when viewing the site as an anonymous user, I can see the link to the page in the menu. When I click on the page's permalink, the response is "Invalid request / Sorry, there is nothing to display" (i.e. protecting the content from non-users, the desired behavior!)

When I log in as "Joe" and try to view the page, I get the same response (i.e. protecting the content from a user who is a member of an allowed group, undesired behavior!)

For chuckles and grins, I've logged into the backoffice as the admin user, who should have superuser privileges on all blogs/posts/pages/etc. When I click on the Permalink listed for the page in the backoffice (where I know I've been authenticated and can edit the page itself), I get the same result ("Invalid request / Sorry, there is nothing to display"). Under the All Posts/Comments section of the Dashboard, the page entry is outlined in yellow and Visibility is listed as "Protected", so the page is recognized as being in protected status/visibility.

Is there anything else I need to do?
***
I apologize for being wordy, but I know that a demonstration of RTFM and using the search feature prior to asking for help is appreciated by more advanced members and developers.


Form is loading...