We have a Drupal 7 site that uses a bespoke login module for ordinary users. Certain (administrative) user rôles, however, must use the core login form at
/user to log in, as they have escalated privileges. Regular users get a login form at
/ (redirected from any URL when not logged in) and cannot log in at
/user; administrative users cannot log in at
/, but must use the form at
/user — these two forms ask different login questions.
We would like to be able to restrict the
/user login form to a whitelist of IP addresses, so that only users coming from known IPs can use this form to log in. This would seem simple, at a first glance, as we could use Apache to reject requests for
^/user$ coming from non-whitelisted IPs, except that Drupal also uses
/user as a redirect to the currently-logged-in users's profile page and this link appears in a handful of locations in our site.
Now I don't want to go hacking through Core, but I can't see how I can enforce the whitelist for anonymous users, whilst allowing any authenticated user to access their own profile page on the URL
Should I go through everywhere that we link to
/user (including the menu block) to substitute in the user's profile ID, or is there some more-elegant solution that I'm just not seeing?
All suggestions gratefully received :o)