Download the PHP package johannschopplich/kirby-locked-pages without Composer
On this page you can find all versions of the php package johannschopplich/kirby-locked-pages. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download johannschopplich/kirby-locked-pages
More information about johannschopplich/kirby-locked-pages
Files in johannschopplich/kirby-locked-pages
Package kirby-locked-pages
Short Description Password-protect pages for the Kirby CMS
License MIT
Homepage https://github.com/johannschopplich/kirby-locked-pages#readme
Informations about the package kirby-locked-pages
When to Use
| I want to… | Use |
|---|---|
| Password-protect a page and its children | fields/locked-pages blueprint group |
| Give visitors a logout link | locked-pages.logout hook |
| Restyle the password form | site/templates/locked-pages-login.php |
| Check lock state from my own code | Guard::isLocked($page) |
| Change the login slug, title, or error messages | johannschopplich.locked-pages options |
Features
🔒 Password Protection
Toggle protection on any page through a globally registered blueprint field group. Visitors are redirected to a login form until they enter the correct password, and the grant is then stored in their session.
The group adds a lockedPagesEnable toggle and a lockedPagesPassword field. Drafts and the error page are never locked, even when the fields are set.
🌳 Subtree Inheritance
Locking a page locks its whole subtree – you only add the field group at the subtree root. Unlocking the parent grants access to every descendant, keyed by the page's language-independent ID, so one unlock covers all translations. Content representations (.json, .xml, .rss, …) are locked alongside the page.
🚪 Logout Hook
Clear a visitor's grants by triggering the locked-pages.logout hook. Wire it to a route, then show a logout link only while the session holds a grant.
🎨 Custom Login Template
The plugin ships a self-contained login template. Drop your own locked-pages-login.php into site/templates/ and Kirby uses it automatically – the bundled template is a good starting point.
Requirements
- Kirby 5
- PHP 8.3+
Installation
Composer (Recommended)
Manual Installation
Download and copy this repository to /site/plugins/kirby-locked-pages.
Options
All options are namespaced under johannschopplich.locked-pages:
| Option | Default | Description |
|---|---|---|
slug |
locked |
Slug of the login form, relative to the site URL. |
template |
locked-pages-login |
Template name for the login form. |
title |
Page locked |
Title rendered on the login form. |
longSession |
true |
Keep grants in a long (2-week) session with no idle timeout. false for a 2-hour one. |
error.password |
The password is incorrect |
Message shown after a wrong password. |
error.csrf |
The CSRF token is invalid |
Message shown when the CSRF token fails. |
Example config.php:
Security Scope
This plugin gates page rendering – nothing else. Know its limits before relying on it:
- Files are not protected. Anything under
/media/pages/...is served statically by the web server, and the URL hash is not a secret – a locked page's images and downloads stay reachable by direct URL. To gate files, serve them through your own route that checksGuard::isLocked($page)before streaming. Kirby's files firewall cookbook covers the approach; adapt it to this plugin's session instead of a Panel login. - Passwords are stored in plaintext in the page's content file, as an editor-visible shared secret. Treat a locked page as hidden from casual visitors, not as a vault.
- Grants last up to two weeks by default. Shorten them with
longSession => false, or clear them through the logout hook.
Credits
Inspired by kirby-securedpages.
License
Johann Schopplich