log1x / sage-password-protected
A simple password protection package for Roots Sage customizable with filters.
Requires
- php: >=7.0
- composer/installers: ^1.0
This package is auto-updated.
Last update: 2024-02-08 13:05:39 UTC
README
Sage Password Protected is a simple password protection package for use with Sage 9 built for developers. No admin pages, no styles, no javascript, no bloat. Simply pass your own configuration to the provided filters and off you go.
Easily build your own field group for it within your theme options using ACF, or pass a filter so it is only enabled when WP_ENV
does not equal production
.
Requirements
Installation
Install via Composer:
composer require log1x/sage-password-protected
Usage
Out of the box, this package does absolutely nothing as all values are defaulted to false. To get started, begin passing your values in an array through the provided filter. When passing the password, you must either pass it through password_hash()
or if using ACF, use my acf-encrypted-password field.
Configuration
Defaults
Below are the default / possible configuration values.
/** * Default configuration for Sage Password Protected * * @return array */ add_filter('password_protected', function () { return [ 'active' => false, 'password' => false, 'secret' => $this->secret, 'allowFeeds' => false, 'allowAdmins' => false, 'allowUsers' => false, 'allowIpAddresses' => false, 'allowedIpAddresses' => [], 'title' => $this->name() ]; });
Example
Below is a personal example of how I handle the configuration alongside ACF and ACF Fluent.
/** * Configuration for Sage Password Protected. * * @return array */ add_filter('password_protected', function () { return [ 'active' => Acf::option('password_protected')->get(), 'password' => Acf::option('password')->get(), 'allowFeeds' => Acf::option('password_show_feeds')->get(), 'allowAdmins' => Acf::option('password_allow_administrators')->get(), 'allowUsers' => Acf::option('password_allow_users')->get(), 'allowIpAddresses' => Acf::option('password_allow_by_ip_address')->get(), 'allowedIpAddresses' => Acf::option('password_allowed_ip_addresses')->get(), ]; });
ACF Builder
If you happen to be utilizing ACF Builder, you can use my above filters along with:
<?php namespace App; use StoutLogic\AcfBuilder\FieldsBuilder; $config = (object) [ 'ui' => 1, 'wrapper' => ['width' => 30], 'ip' => $_SERVER['X-Forwarded-For'] ?? $_SERVER['REMOTE_ADDR'], ]; $password = new FieldsBuilder('password_protected'); $password ->addTab('password_protected', ['placement' => 'left']); $password ->addTrueFalse('password_protected', ['ui' => $config->ui]) ->setInstructions('Enable site-wide password protection?') ->addField('password', 'encrypted_password', ['wrapper' => $config->wrapper]) ->setInstructions('Enter the login password.') ->conditional('password_protected', '==', '1') ->addTrueFalse('password_show_feeds', ['label' => 'Show Feeds?', 'ui' => $config->ui]) ->setInstructions('Enable RSS Feeds without a password?') ->conditional('password_protected', '==', '1') ->addTrueFalse('password_allow_ip_address', ['label' => 'Allow by IP Address', 'ui' => $config->ui]) ->setInstructions('Enable whitelisting users by their IP Address.') ->conditional('password_protected', '==', '1') ->addRepeater('password_allowed_ip_addresses', ['label' => 'Allowed IP Addresses', 'button_label' => 'Add IP Address']) ->conditional('password_protected', '==', '1') ->and('password_allow_ip_address', '==', '1') ->setInstructions('Current IP Address: ' . $config->ip) ->addText('ip_address', ['label' => 'IP Address', 'placeholder' => $config->ip]) ->setInstructions('The IP Address of the user to allow through password protection.') ->addText('ip_address_comment', ['label' => 'Comment', 'placeholder' => 'John Doe\'s Home']) ->setInstructions('A comment containing an identifier for this IP address. This is strictly for organization purposes.') ->endRepeater() ->addTrueFalse('password_allow_users', ['ui' => $config->ui]) ->setInstructions('Allow bypassing password protection while logged in as a user.') ->conditional('password_protected', '==', '1') ->addTrueFalse('password_allow_administrators', ['ui' => $config->ui]) ->conditional('password_protected', '==', '1') ->and('password_allow_users', '==', '0') ->setInstructions('Allow bypassing password protection while logged in as an administrator.'); return $password;
Security
Obviously the cookie isn't absolutely foolproof, my default hash being passed to openssl_encrypt()
is laughable, and storing the encrypted password md5'd as the hash is laughable– but let's be real, this is a simple password protection package to protect your front-facing site during things such as staging (to prevent webcrawling), maintenance, etc. and I personally believe the effort I put into place is extremely overkill as is.
Contributing
Any contributions are appreciated. There are still some things left untouched such as the ability to customize the cookie hash, filtering the Blade view location, etc.
❤️