Password-protection at WebFaction

csf

I'm not sure how similar my problem is to this thread, but I need to put Flarum under password protection too, in order to discuss with my collaborators until Flarum's stable release launches. My web host, WebFaction, has specific instructions for password-protecting a directory.

When I set up the protection as they describe, with only their lines in the .htaccess file, it works fine. But if I try to add those lines to Flarum's .htaccess file, whether at top or bottom, the password protection is removed from the directory. If I remove the Flarum lines from the file again, the protection reinstates again. So there's definitely a conflict somewhere.

If I can't protect the install during beta testing, then the private collaboration we need isn't going to work. I think I'm still using Flarum beta3, so I know I need to update there, but do you have any other thoughts about this?

Thanks in advance.

csf

Why does my "support" post have to be approved, exactly?

luceos

csf akismet marked your post as spam. Probably due to your link.

Kulga

csf You're doing this at the webserver level (through .htaccess)
Have you considered doing this through Flarum itself?
In admin and permissions, you can set View discussions to Members or a particular group.
Then either close Sign ups or make sure your members are part of your chosen group
That way, only the people you want to see the content can and is otherwise a blank slate (since all content is restricted!).

csf

Kulga Have you considered doing this through Flarum itself?

I'll keep that in mind. Thanks.

We're considering Flarum as a replacement for our community of professionals on Google+, and we feel Flarum's UI needs some mods and our brand integrated before we reveal it as a platform to offer. So it's not just about the conversations, it's about the whole thing. We want to launch something that's completely recognizable, trustable, and a long way to being intuitive right from the start, so our members feel comfortable enough moving over, and so we attract other professionals in our community who never liked G+ to begin with.

Part of this, too, is knowing how to customize the UI as we need, which is still a bit of a mystery to us because Flarum documentation is void of this kind of information, except for the push to build extensions. We don't have any developers in our team, so that makes it a little difficult. Sure, and extension will be nice eventually, so we can maintain it easier, and we anxiously await one to emerge from the community. (Surprised there hasn't been one yet.)

So, thinking through this, it looks like we'll have to do the GitHub-local dance for a while on the UI side of things, and when that much is done, make it live and close the threads off as you suggest until we shape up the tag structure and seed it with enough conversations.

jordanjay29

csf Feel free to join us in Gitter chat, we're happy to answer your questions in flarum/developers to make up for the thin deving docs.

Kulga

Examing the .htaccess file I see this section.
This reads (to me)
If the Mod_authz_core exists, Require all granted (which means allow all)
If it doesn't exist, allow all and specifically deny.
So (I am speculating here and is untested) - remove (or better, just comment it out) the below part and swap with your rules since it appears to make sure everyone can access it.
Also note the commented(#) section about the subdirectory compatibility, removing this may break that if you're using a subdirectory.

The rest deals with rewrite and I believe caching and shouldn't be relevant in this case.

# Allow access if Flarum is installed in a subdirectory,
# but another .htaccess in a higher directory denies access.

<IfModule mod_authz_core.c>
  Require all granted
</IfModule>
<IfModule !mod_authz_core.c>
  Order Allow,Deny
  Allow from all
</IfModule>

csf

Kulga

Sorry for the late reply. I will give that a try, at least.

VIRUXE

As Kulga mentioned that part of the .htaccess file needs to be commented out in order for the basic http auth to work. After that just give an htaccessgenerator a try.