What is the URL for user login (aka How to hide the login form?)

Question

I do not wish to allow visitors to register on my website; however, I find a need to have a single registered user for testing purposes. For example, I will publish an article with restricted access so that my test user can see how the article looks on the site without "airing any dirty laundry" to the general public (ok, all 1/day who actually visit...).

My problem at the moment is that I do end up defacing the website since I have to publish/unpublish the user login form. Currently, I 'circumvent' this problem by hiding the login form in a subcategory so that it is not immediately visible to a casual visitor. Is it possible to create an alternative method (e.g. a custom URL) that will allow my test user to view content marked as restricted without altering what a guest with public access would see?

Answer 1

You can make a menu that isn't published, and put a link to the user login page there, and name the alias whatever you want. As long as you turn off the allow registrations function in the user manager options, you should be good.

Then just give your client the url.

So the steps are:

1. Create a new menu, name it Hidden
2. Don't publish a module of the new menu
3. Add a new menu item, choose Users Manager and Login form
4. Title the menu item Login or something so you know what it is, but change the alias to something someone wouldn't guess.
5. Test your form by going to yoursite.com/aliasname

Answer 2

As an extension to Brian Peat's answer:

If you go to the url

domain.com/index.php?option=com_users&view=login

you can login without having a menu item set or any kind of publish/unpublish problem. This could be termed as somewhat of a problem in Joomla as knowing your way around you can still register/login if you know the url structure. There are rules to prevent this but typically by default you can just use direct paths like that to get to where you need to go.

http://www.joomla.org/index.php?option=com_users&view=login

Here is it at work, even the main Joomla site which has no direct access to login can be accessed like that.

My point is, make sure you use proper ACL as well, if its "just" registered users then anyone who knows the structure of Joomla can get in. Also as Brian had said make sure allow registrations is off.

Answer 3

You should be able to accomplish this by overriding the layout for the front-end login form. Add some PHP code near the top of the layout file. This added code checks for a custom parameter in the URL and for a particular value. If someone tries to access the login page through any URL but does not include the custom parameter and particular value (such as abc=xyz), then the code issues a "return;" so that the layout of the form will not be processed for display.

With this code in the overriding layout file, only a user who knows the URL (that includes this custom parameter and an acceptable value) will be able to use that login form.

For example: The secret URL can be

mydomain.com/?option=com_users&view=login&abc=xyz

Then add this code near the top of the overriding layout file for the login form:

if(JFactory::getApplication()->input->get('abc')!='xyz'){
    return;
}

Answer 4

I often faced a similar problem because I often want a front-end login in order to edit websites I manage, without the need to have a login form. I ended up creating a small bookmarklet that I added to my browser toolbar. This is obviously a very "local" solution, as the bookmarklet only is available to me (or anyone I copy the code to), but it works on ANY Joomla site and is an incredible time saver, simply click the link and the login form will be shown (given that you are on a Joomla site, of course...).

 javascript:void((function(){var loc = location.href; loc.indexOf("?") == -1 ? (location.href = loc+"?option=com_users&view=login") : (location.href = loc+"&option=com_users&view=login");})());