Re: [pebble-user] private blog problem

[Simon B. <sim...@gm...>]

Hi Joe,

I've reopened PEB-160 - I always assumed that this was an issue for a
multi-user setup, but the original author of that issue never got back
to me. I'll take a look at sorting this out. During my CSS'ing of the
webapp, I've taken off the image from the login page on the next
version of Pebble so this should be easy to fix.

In the meantime, you could run a multi-blog instance with a single
blog and make that blog private. This would achieve what you're trying
to do, although your blog URL would be slightly longer.  e.g.

http://www.yourdomain.com/blog/ <- mutli-user Pebble instance
http://www.yourdomain.com/blog/private/ <- your actual blog

You just need to then set the protected URL to be /private/* in the
web.xml file. To stop anybody seeing your content, you can use the
private/public option on the blog properties page - the main
multi-blog page will be empty.

A nice side-effect of this is that you can always add a /public/ blog
later on if you want a way to publish *some* content to the outside
world, just by creating another blog. I do something similar at work -
rather than sending CruiseControl build reports to a specific category
in a single blog, I send them to another blog running on a multi-blog
instance. Keeps them nice and separate that way and means I can easily
secure up the main project blog if necessary.

I'll take a look into this but I hope that helps in the meantime.

Cheers
Simon


On Sat, 22 Jan 2005 21:15:00 -0500, joseph panico <jo...@pa...> wrote:
> Hi,
> 
> I followed the instructions in the documentation for configuring a private
> blog, but I've encountered (a not surprising) problem.
> 
> I'm running the default configuration-- I haven't changed anything in the
> pebble.properties file. So I have a single (simple) blog running in Tomcat 5.
> Here's the security-constraint for the private blog:
> 
>   <security-constraint>
>     <web-resource-collection>
>       <web-resource-name>Private Blog Realm</web-resource-name>
>       <url-pattern>/*</url-pattern>
>       <http-method>GET</http-method>
>       <http-method>HEAD</http-method>
>       <http-method>POST</http-method>
>     </web-resource-collection>
>     <auth-constraint>
>       <role-name>privateblog-user</role-name>
>     </auth-constraint>
>   </security-constraint>
> 
> This works, in the sense that I cannot access any page on the blog without
> first authenticating as a user that has the privateblog-user role. However,
> when Tomcat security redirects me to the pebble login FORM page, trouble
> starts. The problem is that the login FORM page references resources that are
> protected by the private blog security constraint. For instance:
> 
> <link rel="stylesheet" href="/pebble/pebble.css" type="text/css" />
> <img src="/pebble/common/images/powered-by-pebble.gif" />
> 
> are both protected and don't show up on the login page. As a result, the
> formatting of the login page is very broken. Worse still, after I log in, I
> end up here:
> 
> /pebble/common/images/powered-by-pebble.gif
> 
> and not on the expected front page of my blog. I'm guessing this happens
> because Tomcat is now fulfilling the request for powered-by-pebble.gif that
> was blocked before authentication.
> 
> This is basically the same problem described by this filed bug report:
> 
> http://www.simongbrown.com/jira/secure/ViewIssue.jspa?key=PEB-160
> 
> (issue PEB-160 on JIRA).
> 
> However, I tried the fix suggested in that issue, but no joy.
> 
> So far I much prefer Pebble over the other open-source blogs I've tried, but
> this problem is quite annoying and I really need my blog to be private.
> 
> Any help much appreciated.
> 
> thanks,
> 
> joe
> --
> Open WebMail Project (http://openwebmail.org)
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
> Tool for open source databases. Create drag-&-drop reports. Save time
> by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
> Download a FREE copy at http://www.intelliview.com/go/osdn_nl
> _______________________________________________
> Pebble-user mailing list
> Peb...@li...
> https://lists.sourceforge.net/lists/listinfo/pebble-user
>