XH 1.6: Login Form detached from Template

[cmb]

Hello Community,

there were several internal discussions regarding the improvement of the security of CMSimple_XH; I will not go into details publicly until the issues are solved (don't be afraid -- these are minor issues anyway). But during this discussions some suggestions were made, which may be discussed here (and voted upon on the roadmap). I'll bring those up as two separate topics, as there are not directly related.

The first one is related to Holger's maintenance plugin. The maintenance plugin allows the admin to put his site to maintenance mode, which means that he is able to access the site as usual while he's making changes which should not be publicly visible; meanwhile visitors of the site will see an appropriate message that the site is in maintenance mode and they may visit the site later. This message is shown for all (deep) links leading to the respective CMSimple installation, except for the login form (consider the admin has logged out without deactivating the maintenance mode, what might happen even unadvertently, for instance due to a browser crash; in this case the login link on the maintenance message page is very useful). Displaying the login form as hitherto shows the template which might be work in progress (even erroneous).

So the idea is to detach the login form from the template. This can be done very similar to the handling of the print mode. Actually I have already implemented this as POC (r659). As generalization I have written XH_builtinTemplate($class) which uses the usual print "template"; giving the BODY element class $class (may be used for some individual styling). To see how this will look like you can access any CMSimple installation which has security_type=page: http://example.com/?login&print; via the class of the BODY element this can be styled to be centered for example.

I suggest we make it so.

Christoph