- 🇳🇿New Zealand quietone
The Ideas project is being deprecated. This issue is moved to the Drupal project. Check that the selected component is correct. Also, add the relevant tags, especially any 'needs manager review' tags.
Security issues occur. Security update will be made available at specific times. Not every Drupal user has a 24/7 SLA in place. Sometime people run sites for fun and go on holiday to remote Scottish islands and don't know if they will have internet. Drupal could provide an easy way to put a site into read only mode.
Prior art: https://www.drupal.org/project/readonlymode →
There are a couple of options:
Add a read only module or mode to core or just make it part of system. When enabled the module will redirect all non-safe requests to a read only page whose message can be configured by an administrator and translated via Configuration translation. The module will also strip all user content apart from the url path from the incoming request to prevent attacks where something is possible with query string parameters or cookies.
As noted by @fago this approach currently has the downside or breaking pagers and basic search. We could allow the the page or keys query parameter through after type checking them. However allowing any input is bound to make this mode less secure.
This works via a new state variable that contains a timestamp when in operation. It is a timestamp so that users can schedule a future time when the site becomes read only.
Allow the user to further lock the site in maintenance mode and redirect to the maintenance page for all non-cached pages apart from a single page that unlocks the site if you have the right token. In a way this is what option 1 + maintenance mode would be like.
New admin form
Maybe new module
New service to generate tokens for disabling the read only mode
None
Needs review
11.0 🔥
base system
It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.
Issue summaries save everyone time if they are kept up-to-date. See Update issue summary task instructions.
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
The Ideas project is being deprecated. This issue is moved to the Drupal project. Check that the selected component is correct. Also, add the relevant tags, especially any 'needs manager review' tags.