{"action":"created","issue":{"url":"https://api.github.com/repos/eventespresso/event-espresso-core/issues/344","repository_url":"https://api.github.com/repos/eventespresso/event-espresso-core","labels_url":"https://api.github.com/repos/eventespresso/event-espresso-core/issues/344/labels{/name}","comments_url":"https://api.github.com/repos/eventespresso/event-espresso-core/issues/344/comments","events_url":"https://api.github.com/repos/eventespresso/event-espresso-core/issues/344/events","html_url":"https://github.com/eventespresso/event-espresso-core/issues/344","id":317464989,"node_id":"MDU6SXNzdWUzMTc0NjQ5ODk=","number":344,"title":"Add Request Stack Middleware app for detecting Maintenance Mode and use a key to control access","user":{"login":"sethshoultes","id":235315,"node_id":"MDQ6VXNlcjIzNTMxNQ==","avatar_url":"https://avatars3.githubusercontent.com/u/235315?v=4","gravatar_id":"","url":"https://api.github.com/users/sethshoultes","html_url":"https://github.com/sethshoultes","followers_url":"https://api.github.com/users/sethshoultes/followers","following_url":"https://api.github.com/users/sethshoultes/following{/other_user}","gists_url":"https://api.github.com/users/sethshoultes/gists{/gist_id}","starred_url":"https://api.github.com/users/sethshoultes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sethshoultes/subscriptions","organizations_url":"https://api.github.com/users/sethshoultes/orgs","repos_url":"https://api.github.com/users/sethshoultes/repos","events_url":"https://api.github.com/users/sethshoultes/events{/privacy}","received_events_url":"https://api.github.com/users/sethshoultes/received_events","type":"User","site_admin":false},"labels":[{"id":904083500,"node_id":"MDU6TGFiZWw5MDQwODM1MDA=","url":"https://api.github.com/repos/eventespresso/event-espresso-core/labels/category:core-plugin","name":"category:core-plugin","color":"abc2c1","default":false}],"state":"open","locked":false,"assignee":{"login":"tn3rb","id":1751030,"node_id":"MDQ6VXNlcjE3NTEwMzA=","avatar_url":"https://avatars1.githubusercontent.com/u/1751030?v=4","gravatar_id":"","url":"https://api.github.com/users/tn3rb","html_url":"https://github.com/tn3rb","followers_url":"https://api.github.com/users/tn3rb/followers","following_url":"https://api.github.com/users/tn3rb/following{/other_user}","gists_url":"https://api.github.com/users/tn3rb/gists{/gist_id}","starred_url":"https://api.github.com/users/tn3rb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tn3rb/subscriptions","organizations_url":"https://api.github.com/users/tn3rb/orgs","repos_url":"https://api.github.com/users/tn3rb/repos","events_url":"https://api.github.com/users/tn3rb/events{/privacy}","received_events_url":"https://api.github.com/users/tn3rb/received_events","type":"User","site_admin":false},"assignees":[{"login":"tn3rb","id":1751030,"node_id":"MDQ6VXNlcjE3NTEwMzA=","avatar_url":"https://avatars1.githubusercontent.com/u/1751030?v=4","gravatar_id":"","url":"https://api.github.com/users/tn3rb","html_url":"https://github.com/tn3rb","followers_url":"https://api.github.com/users/tn3rb/followers","following_url":"https://api.github.com/users/tn3rb/following{/other_user}","gists_url":"https://api.github.com/users/tn3rb/gists{/gist_id}","starred_url":"https://api.github.com/users/tn3rb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tn3rb/subscriptions","organizations_url":"https://api.github.com/users/tn3rb/orgs","repos_url":"https://api.github.com/users/tn3rb/repos","events_url":"https://api.github.com/users/tn3rb/events{/privacy}","received_events_url":"https://api.github.com/users/tn3rb/received_events","type":"User","site_admin":false}],"milestone":null,"comments":2,"created_at":"2018-04-25T03:13:42Z","updated_at":"2018-09-01T16:38:12Z","closed_at":null,"author_association":"MEMBER","body":"See original Codebase ticket for details and discussion:\nhttps://events.codebasehq.com/projects/event-espresso/tickets/11217\n\nRight now, if Maintenance Mode (MM) is active because of data migrations or because an admin has activated it, any incoming requests to the server STILL have the potential to cause problems because  it takes far too long for us to detect that MM is active. In that time it is possible for addons to register and begin running code and/or who knows what (as well as core itself). Basically our current system is not as secure   as it could be. The problem has always been that we can't detect MM early enough.\n\nCurrently however, every incoming request runs through a series of Request Stack Middleware apps (MW) in core before `EE_System` finally loads. One of the purposes of the MW is to terminate the request  if it  has been determined that it should not continue. This is currently only done if an older incompatible version of WP is detected (we also used to do this for PHP versions less than 5.3, but that detection has now been moved into espresso.php to allow us to use namespacing during bootstrapping). I realized that we could add a MW app for detecting if MM is active, but in order for this to work, we would also need to set a key so that any MM related requests could still pass through. \n\nRight now, when MM is active, we only record the level using an int as follows:\n\nfrom: `\\event-espresso-core\\core\\EE_Maintenance_Mode.core.php`\n\n```\n    /**\n     * constants available to client code for interpreting the values of EE_Maintenance_Mode::level().\n     * level_0_not_in_maintenance means the site is NOT in maintenance mode (so everything's normal)\n     */\n    const level_0_not_in_maintenance = 0;\n\n    /**\n     * level_1_frontend_only_maintenance means that the site's frontend EE code should be completely disabled\n     * but the admin backend should be running as normal. Maybe an admin can view the frontend though\n     */\n    const level_1_frontend_only_maintenance = 1;\n\n    /**\n     * level_2_complete_maintenance means the frontend AND EE backend code are disabled. The only system running\n     * is the maintenance mode stuff, which will require users to update all addons, and then finish running all\n     * migration scripts before taking the site out of maintenance mode\n     */\n    const level_2_complete_maintenance = 2;\n```\n\nwhat I'm proposing, is that we instead generate a random key and save that to the db instead. Since we need to know the  MM level, we could either save a JSON object that contains the key as well as MM level, and any other data we might want to save (preferred), OR we could simply prepend/append the MM level to the key, so the first (or last) character of the key would represent the MM level. Any key starting in a 1 would represent `level_1_frontend_only_maintenance ` and any key starting in a 2 would represent `level_2_complete_maintenance1. The Request object could then record the MM level, which would make it easy for the rest of core to check.\n\nThe MM detection MW app would then check the MM db option to see if a key has been saved, and if so, then also check if the incoming request contains that key. If not, then the request is terminated and a discreet notification is returned instead  to inform the  current user that the Registration and Event related systems  are  down for maintenance. This prevents EE core from even loading for unwanted requests, which almost completely shuts down the potential for problems to occur due to things happening during MM  that should not (like queries)\n\nFor any requests that **need** to be made during MM, then this key could be added to to them so that the MM detection MW app lets them pass. This could be done  as a request var, or even  as a cookie.\n\nWhile discussing this with Darren in chat, he added that it could be extended to allow registrations in progress to continue  when a site has been  switched to MM,  and then only proceed with site maintenance when those registrations are all complete. This could be done by recording the Session IDs for all registrations in progress with the MM data saved to the db. So the MM detection MW app would then check the MM db option and see a key indicating that MM has  been activated, but ALSO sees that there are Session IDs which indicates that there are registrations  in progress. So at that point, the incoming request would **only** be allowed to pass if:\n\n * it contained the correct MM key\n * it contained a Session ID that belongs to a registration in progress\n\nOnce the list of registrations in progress is cleared, regular MM activity would  proceed.\n\nthoughts?"},"comment":{"url":"https://api.github.com/repos/eventespresso/event-espresso-core/issues/comments/417871394","html_url":"https://github.com/eventespresso/event-espresso-core/issues/344#issuecomment-417871394","issue_url":"https://api.github.com/repos/eventespresso/event-espresso-core/issues/344","id":417871394,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNzg3MTM5NA==","user":{"login":"stale[bot]","id":26384082,"node_id":"MDM6Qm90MjYzODQwODI=","avatar_url":"https://avatars3.githubusercontent.com/in/1724?v=4","gravatar_id":"","url":"https://api.github.com/users/stale%5Bbot%5D","html_url":"https://github.com/apps/stale","followers_url":"https://api.github.com/users/stale%5Bbot%5D/followers","following_url":"https://api.github.com/users/stale%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/stale%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/stale%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stale%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/stale%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/stale%5Bbot%5D/repos","events_url":"https://api.github.com/users/stale%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/stale%5Bbot%5D/received_events","type":"Bot","site_admin":false},"created_at":"2018-09-01T16:38:12Z","updated_at":"2018-09-01T16:38:12Z","author_association":"NONE","body":"This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.\n"}}
{"actor":{"display_login":"stale"}}