Keymaster_XH facilitates locking the administration area of a CMSimple_XH website, if a user is already logged in. This is necessary in case there is more than one user who has access to the back-end, as CMSimple_XH's back-end doesn't take any precautions against concurrent editing. After a configurable period of inactivity the admin is automatically logged out, to avoid locking the site "forever", if they forgot to log out properly. Before this happens the admin is warned and offered the possibility to prolong the session, to avoid loosing unsaved changes.
Please do read this documentation before you encounter any problems!
Keymaster_XH is a plugin for CMSimple_XH. It requires a UTF-8 encoded version.
The installation is done as with many other CMSimple_XH plugins. See the CMSimple_XH wiki for further details.
The plugin's configuration is done as with many other CMSimple_XH plugins in the website's administration area. Select Plugins → Keymaster.
You can change the default settings of Keymaster_XH under "Config". Hints for the options will be displayed when hovering over the help icons with your mouse.
Localization is done under "Language". You can translate the character strings to your own language if there is no appropriate language file available, or customize them according to your needs.
The look of Keymaster_XH can be customized under "Stylesheet".
After installation the plugin is already fully functional.
If no user is logged in to the administration mode, the keymaster holds a single key. As soon as a user logs in, the key is given to this user and access to CMSimple_XH's administration is granted. As there is only one key, no other user can log in; they're simply rejected with an appropriate message (but see limitations).
After some configurable period of inactivity the user is logged out, what returns the key to the keymaster. Inactivity means a period in which no request, which can be recognized by the keymaster, to the server is made. A configurable time before the user is logged out, he is prompted to prolong the session, which then triggers a recognizable request.
Having multiple browser windows (resp. tabs; in the following the term browser window refers to browser tabs as well) open for the same CMSimple_XH installation is possible; activity in one window is recognized in the others by the keymaster, what may take a little while, though (depending on the poll interval).
Caveat: editing a CMSimple_XH site in more than one browser window does not generally work. Unless you know exactly what you're doing, make modifications only in the main window, and treat the others as read-only.
In case you have missed to prolong the session in time and you have been logged out by the keymaster while there were some unsaved changes, there is a chance to get them back: log in to the site from another window of the same browser and press the back button in the original window. If you're lucky, your changes are still there.
For security_type="javascript" resp. "wwwaut" the login attempt of a second user will not show any message; the user simply can't login. Solution: switch to security_type="page".
Some extensions (e.g. Chat_XH) periodically send background requests to the server, which might be recognized by the keymaster as activity. If such an extension is active, the automatic logout does not work, i.e. other users will not be able to log in until the browser window is closed. Solution: always log out properly after you're finished with editing the website.
If a logged in user closes the browser window (but not the complete browser), and another user logs in later, the first user is able to circumvent the keymaster's check by browsing to the CMSimple_XH installation again. Solution: log out properly when you're done with the editing (at least close the browser).
After changing the admin password, the website is locked for the duration of the automatic logout period. Solution: change the admin password after you're finished with other editing activities.
When you are logged in to another CMSimple_XH installation in a parent folder, Keymaster doesn't permit log in. Solution: log out from the other installation first.
Keymaster_XH is licensed under GPLv3.
© 2013-2019 Christoph M. Becker
French translation © 2014 Patrick Varlet
Keymaster_XH was inspired by Martin Damken's and Gert Ebersbach's LoginLocker and a brilliant Movie (guess which ;)).
The plugin icon is designed by Alessandro Rei. Many thanks for publishing this icon under GPL.
This plugin uses free applications icons from Aha-Soft. Many thanks for making these icons freely available.
Many thanks to the community at the CMSimple_XH-Forum for tips, suggestions and testing.
And last but not least many thanks to Peter Harteg, the "father" of CMSimple, and all developers of CMSimple_XH without whom this amazing CMS wouldn't exist.