Password protect entire site

24

I’ll try!
What do I name the snippet? And what do you mean with checkbox?

25

It’s not a snippet. It’s a plugin. (They are also listed in the “Elements” tab, below the snippets).

The plugin page has a tab “System Events” where all MODX events are listed. Tick the checkbox for “OnWebPagePrerender” so that the plugin runs on that event.

26

Ah sorry, thought it was the same.
What do I call it? And how does this work? It gives a ‘Page not found’

27

The name of the plugin is irrelevant. You can call it whatever you like.

Did you set $formResourceID to the correct value. Is the page with the password form published?

A request to any page gets redirected to the page with the password form, if in the session variable $_SESSION the user isn’t set as “logged in”.

28

Yes, resourceID is correct and that page is published. The entire site is now ‘not found’ (I’m using a different browser, cleared cache, etc.).

29

Can you view the page with the password form on the frontend?

If not, deactivate the custom plugin. (There is a checkbox “Inactive plugin” for that in the plugin page.)

Can you view the page with the password form on the frontend now? If not, then the problem is not the plugin.

30

Yeah the page (and site) is available with the plugin disabled.

31

The plugin code does nothing at all, when the requested page is the page with the password form:

So if you can’t see the page when the plugin is enabled, but you can see it when the plugin is disabled, then I have no clue what is going on.

32

I don’t have a clue as well. I just used your code.

33

I just gave @halftrainedharry code a try - seems to work OK.

1 Like
34

So what is wrong? I only changed the resource ID and password.

35

When you change the plugin code to this, does this still break the site?

<?php
$eventName = $modx->event->name;
switch($eventName) {
    case 'OnWebPagePrerender':
        $sitePW = "mysupersecretpassword";
        $formResourceID = 123;

        break;
}

(This code does nothing. It’s just to figure out where it breaks.)

36

I got it to work! I still had an active resource group, so it was blocking the Login page, oops.

37

Speaking about resource groups: I followed the steps mentioned above and this excellent tutorial:
https://docs.modx.com/3.x/en/building-sites/client-proofing/security/security-tutorials/making-member-only-pages
I created a resource group and user group with ‘Web’ access Load-List-and-View.

But when these users try to log in to the Manager, they get an access denied.

I feel there are missing some steps in the explanation.

38

I think this tutorial is for logging in to the frontend, and not the manager.
You need the Login extra, to show a login page on the frontend.
If you want the user to be able to log into the manager, you need to give them access to the mgr context.

39

THANK YOU @halftrainedharry! Beauty

40

FYI, generally a login page should be published and should never be in any resource groups.

The only use case I can think of for putting a login page in a Resource Group is if you have multiple tiers of protected pages where users pay extra to get to the deeper tiers.