7

these days I have deployed a magento instance, but the webshop is not online yet, so I have added an .htaccess password protection to the website which indeed worked fine, but caused problems when my client wanted to upload images for his products.

Is there a way to password protect the whole store for development purposes, using magento-capabilities itself, so that logged in user has full access to the page, but not the public?

I came over this module, but it is unfortunately not compatible with magento 1.8, or I do not know how to install it.

Thanks for help!

  • Did you manage to solve your issue? – Sander Mangel Feb 24 '14 at 20:56
  • Your answer looks very good, I will try it as fast as I can, but right now I am unfortunately bothered with something else, but I will let you know as soon as possible! – philipp Feb 25 '14 at 10:08
  • A workaround to make the flash upload work without authentication can be found here: stackoverflow.com/questions/9675004/… (Warning: this is unsecure because it doesn't prevent access to the site, just makes accessing it complicated. So use with care) – Fabian Schmengler Mar 4 '15 at 15:46
3

You can write a small custom extension that checks if the user has permission to access the site.

Your config.xml would look something like this

<?xml version="1.0"?>
<config>
   <modules>
      <[Namespace]_[Module]>
         <version>1.0.0</version>
      </[Namespace]_[Module]>
   </modules>
   <global>
      <models>
         <[module]>
            <class>[Namespace]_[Module]_Model</class>
         </[module]>
      </models>
      <events>
         <controller_front_init_before>
            <observers>
               <[namespace]_[module]_access_observer>
                  <type>singleton</type>
                  <class>[Namespace]_[Module]_Model_Observer</class>
                  <method>checkAccess</method>
               </[namespace]_[module]_access_observer>
            </observers>
         </controller_front_init_before>
      </events>
   </global>
</config>

And your observer class something like this

class [Namespace]_[Module]_Model_Observer
{
   public function checkAccess()
   {
      $adminurl = (string)Mage::getConfig()->getNode('admin/routers/adminhtml/args/frontName');

      $urlstring = Mage::helper('core/url')->getCurrentUrl();
      $url = Mage::getSingleton('core/url')->parseUrl($urlstring);

      if (strstr($url->path, "/{$adminurl}"))   return $this; // this is the admin section

      // get admin session
      Mage::getSingleton('core/session', array('name' => 'adminhtml'))->start();

      $admin_logged_in = Mage::getSingleton('admin/session', array('name' => 'adminhtml'))->isLoggedIn();

      // return to frontend section
      Mage::getSingleton('core/session', array('name' => 'frontend'))->start();

      if (!$admin_logged_in)
      {
         die('No access!');
      }
   }
}
  • Does this work, @sander? I have had mixed results with trying to start adminhtml session and then restore it to the origination session... – philwinkle Feb 19 '14 at 15:40
  • I have something like this working on a 1.5 store. I'm testing right now on 1.8 :) – Sander Mangel Feb 19 '14 at 15:48
  • 1
    I've updated the code, this is tested on Magento 1.8.0.0 – Sander Mangel Feb 19 '14 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.