Multiple user login.

[JWH_Matthew]

Would anyone be willing to change the core and turn this system into a multi user system?

I have seen XML login systems that Look for a file that's called what ever the user inputs as the username. If it exists then it opens it and confirms the passwords match.

This doesn't need to be an official release just need it for one client who requires multiple user login.

I am not sure what the security risk is when doing it that way but I would love any insight

The only part I think would be hard would be the management area.

[2ELEVEN]

I second this.

[r2d2]

It's GetSimple and not GetComplicated ...

[yojoe]

r2d2: I'd gladly see such feature in GS, because I have sometimes to change or add some things in client's admin panel. If he won't change ftp password, then I can just switch user.xml.
But it's a hassle for me if I have to firstly get access to ftp.

It can be just plain simple to have for example max 3 logins, who may be added manually to user.xml (no user management in GS admin).

[JWH_Matthew]

It's GetSimple and not GetComplicated ...

If you can justify how this would make GS complicated I would be glad to hear it!

[rogerstreets]

If i got some free time, I'll have a look into it. Or you can try it yourself.
Get Simple always looks for the user.xml from there the $USR var is set and compared with the $userid. $userid is the login form username. This is just the login form so you need to do the cookie_functions to. Rewrite it so when the cookie is checked it looks in the whole directory for the username. The function for making of the var $USR is done in inc/common.php.

I only think there will be a security issue.

Greets

[JWH_Matthew]

Would it be possible to use one XML file for all users like so:

Code:

<users>
<user id="1">
<username>admin</username>
<password>encrypted pass</password>
</user>
<user id="2">
<username>user</username>
<password>encrypted pass</password>
</user></users>

[r2d2]

It's GetSimple and not GetComplicated ...

If you can justify how this would make GS complicated I would be glad to hear it!

Well in my personal opinion the only reason for using GetSimple is the simplicity. There are already like a million cms that have endless features. If people are looking for a lot of bloat, they would directly take Joomla, Typo3, TangoCMS, Drupal, CMS Made Simple, ModX, PHP-Fusion, Wordpress, Mambo, Xoops, PHP-Nuke, Enano, Kontao, eZ-Publish, Concrete5, e107, sNews, Cutephp, ImpressCMS, Silverstripe ... [place your bloat-cms here]

I respect your wish for more features, but IMO it would be better to concentrate onto core competencies:

• as simple as it is possible
  
• as fast as possible
  
• make it userfriendly
  
• make it secure
  

It's just my opinion, but as far as I know GetSimple was constructed for small sites. So the only real need is to make it as easy as possible to enable the people to easily update their site with the most possible efficiency. To include more and more new features is a contradiction of this goal.

I'm a programmer myself for many years, so I know that it is only a small step to include nearly every feature wanted by somebody. I really respect this, but it's also a great danger to loose the focus from primary goals.

No offense, but a cms is only a tool to get the job done and that's the reason why I love GetSimple - it gets the job done without tons of useless bloat. If I'm in need of a cms for something from the middle or bigsize market, I choose another proper tool like Typo3 or Joomla.

[dig412]

I see your point, and adding feature upon feature in this manner would defeat the point of GS, but at it's core this is a fairly simple addition.

It's not going to be a Wordpress/phpBB role based ACL monstrosity, that should be kept for the larger CMSs, but just a way to allow the use of more than one account for the admin panel. They wouldn't even have to have any effect beyond that (no "posted by UserX" stuff), but it would allow clients to have any username, and change their password as much as they want, but still allow you access through a standard account.

It could probably be done in 1-2k of code, and in a CMS where the admin panel is 300k, it's hardly going to turn it into bloatware!

[JWH_Matthew]

Exactly dig412, my issue is the fact that I have a client that has two employees that both want access to the site. Yes I could give one general username and password but they specifically requested that we have 2 separate accounts. This shouldn't be an issue at all to add. I wish it could be a plugin but due to the lack of hooks available in the login area this is not possible. If either one of you want to look and tell me what hooks need implemented and I will see what we can do to get them implemented to create this as a plugin

[yojoe]

Matthew: I have a quite simple idea.
user.xml could contain more users added manually (let's say up to 3)
But login_functions would have to check all items inside xml file.

This way I could have the possibility to make some changes in content w/o switching user.xml file.
Other thing is that ftp passwords are being changed, and waiting to get new passes from site owners takes too much time.

[JWH_Matthew]

I agree 100% I think we could do this pretty easy and I really don't see why it couldn't be added to svn but Ill leave that up to the devs I just need this for one client at the moment!

Anyone willing to get this done?

[loranger]

I would definitely love this feature too

[JWH_Matthew]

Almost finished with this, i am attempting to get it added into the core, I have done the login, and the administration. I need to do the initial install and I will be done!! Well other then testing and attempting to hack it!

[yojoe]

Could you describe how did you solve the matter of multiuser login ?
How it will work when salt option will be turned on ?

[badcat]

Looks like it didn't make it to core

[ccagle8]

Looks like it didn't make it to core

Matt and I have talked... It will be in the next release since he isnt quite done with it now. This release was long over due because of the XSS security problems it's predecessor had.

[JWH_Matthew]

Could you describe how did you solve the matter of multiuser login ?
How it will work when salt option will be turned on ?

I'm not really understanding you, nothing should change in how it works now and how it will work in the feauture. Essentially the only thing that will change is users.XML to username.XML and it will search through all the files instead of just reading one.

[yojoe]

I'm not really understanding you, nothing should change in how it works now and how it will work in the feauture. Essentially the only thing that will change is users.XML to username.XML and it will search through all the files instead of just reading one.

So every user will have its own xml file with nick, mail, and pass.
What is the way of adding new users ? Through admin panel, or manually ?


ps. I thought there will be just one xml file, containing all user data.

[JWH_Matthew]

We have moved away from one user file to keep it simple, the GetSimple core will not actually contain multiple user login. Without the plugin I will be releasing, you will have to manually creat additional user files. With my plugin you will be able to creat, edit, and delete users.

[yojoe]

Sounds awesome, as it offers a seamless access for website creators

[superyms]

personally i will enjoy having a multiple user management login with not so much complicate configuration to what to be access...

thank you.

[ccagle8]

@superyms - agreed.

The way Matt and I have decided to implement this is by utilizing our plugin system. Matt has gone thru and found out what needs to change to allow multiple user logins - and I will add the hooks into the core to allow it to happen.

So by default GS will be a single user CMS, but with the help of a plugin, it can be turned into a multiple user platform.

I think it's a perfect scenario as it will keep the core of GS simple and non-confusing, but still allow multiple user capability when the minority of people need it.

[yojoe]

Any progress with this plugin guys ?

[JWH_Matthew]

The plugin hooks along with the revamped login should be released with the next release. (None have been implemented yet though).

I will release my plugin for beta testing shortly after the updates have been added to the SVN. (probably only a handful of people)