{"action":"created","issue":{"url":"https://api.github.com/repos/xenocrat/chyrp-lite/issues/28","repository_url":"https://api.github.com/repos/xenocrat/chyrp-lite","labels_url":"https://api.github.com/repos/xenocrat/chyrp-lite/issues/28/labels{/name}","comments_url":"https://api.github.com/repos/xenocrat/chyrp-lite/issues/28/comments","events_url":"https://api.github.com/repos/xenocrat/chyrp-lite/issues/28/events","html_url":"https://github.com/xenocrat/chyrp-lite/issues/28","id":140326470,"number":28,"title":"Login page for guests without `View Site` permission","user":{"login":"kehugter","id":6382342,"avatar_url":"https://avatars.githubusercontent.com/u/6382342?v=3","gravatar_id":"","url":"https://api.github.com/users/kehugter","html_url":"https://github.com/kehugter","followers_url":"https://api.github.com/users/kehugter/followers","following_url":"https://api.github.com/users/kehugter/following{/other_user}","gists_url":"https://api.github.com/users/kehugter/gists{/gist_id}","starred_url":"https://api.github.com/users/kehugter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kehugter/subscriptions","organizations_url":"https://api.github.com/users/kehugter/orgs","repos_url":"https://api.github.com/users/kehugter/repos","events_url":"https://api.github.com/users/kehugter/events{/privacy}","received_events_url":"https://api.github.com/users/kehugter/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-03-12T00:38:26Z","updated_at":"2016-03-12T10:06:23Z","closed_at":null,"body":"If you remove all permissions from a guests, chyrp-lite's root looks fine:\r\n\r\n```\r\nAccess Denied\r\nYou are not allowed to view this site.\r\n```\r\n\r\nNothing else is displayed. `index.php` prevents users from locking themselves out (https://github.com/xenocrat/chyrp-lite/blob/5a483b7144088a3343ebcc3e34d3be9055d4d3a9/index.php#L15), which is good. However, i see some problems:\r\n\r\n- the allowed actions (login, et al) are displayed inside the site default theme. That means that email, tags and other information that shouldn't be public is revealed.\r\n- `/?action=login` is easy for the admin to remember, but not for collaborators. The root should display the login form if necessary.\r\n\r\nI think that an independent login + register page (that doesn't extend default.twig) for this case would be the best way to go. It has the positive side effect of reducing chyrp-lite's fingerprint.\r\n\r\nIf the site is public, then there's no problem in keeping the login form inside the default template."},"comment":{"url":"https://api.github.com/repos/xenocrat/chyrp-lite/issues/comments/195708258","html_url":"https://github.com/xenocrat/chyrp-lite/issues/28#issuecomment-195708258","issue_url":"https://api.github.com/repos/xenocrat/chyrp-lite/issues/28","id":195708258,"user":{"login":"xenocrat","id":4855211,"avatar_url":"https://avatars.githubusercontent.com/u/4855211?v=3","gravatar_id":"","url":"https://api.github.com/users/xenocrat","html_url":"https://github.com/xenocrat","followers_url":"https://api.github.com/users/xenocrat/followers","following_url":"https://api.github.com/users/xenocrat/following{/other_user}","gists_url":"https://api.github.com/users/xenocrat/gists{/gist_id}","starred_url":"https://api.github.com/users/xenocrat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xenocrat/subscriptions","organizations_url":"https://api.github.com/users/xenocrat/orgs","repos_url":"https://api.github.com/users/xenocrat/repos","events_url":"https://api.github.com/users/xenocrat/events{/privacy}","received_events_url":"https://api.github.com/users/xenocrat/received_events","type":"User","site_admin":false},"created_at":"2016-03-12T10:06:23Z","updated_at":"2016-03-12T10:06:23Z","body":"A totally private site is quite a niche requirement. This can be handled by writing a simple module that responds to the \"can_not_view_site\" [trigger](https://github.com/xenocrat/chyrp-lite/wiki/Introduction-to-Triggers) and displays a custom/standalone login page including specific instructions telling the user how to acquire a login if they don't have one (i.e. a paywall). Maybe I'll put something together to show how it could be done.\r\n\r\nIf you want to use the default login form but you are worried about leaking data, you can wrap the display of those things in `{% if visitor.group.can(\"view_site\") %}` Twig conditional."}}