We have a Drupal 7 site that uses a bespoke login module for ordinary users. Certain (administrative) user rôles, however, must use the core login form at /user
to log in, as they have escalated privileges. Regular users get a login form at /
(redirected from any URL when not logged in) and cannot log in at /user
; administrative users cannot log in at /
, but must use the form at /user
— these two forms ask different login questions.
We would like to be able to restrict the /user
login form to a whitelist of IP addresses, so that only users coming from known IPs can use this form to log in. This would seem simple, at a first glance, as we could use Apache to reject requests for ^/user$
coming from non-whitelisted IPs, except that Drupal also uses /user
as a redirect to the currently-logged-in users's profile page and this link appears in a handful of locations in our site.
Now I don't want to go hacking through Core, but I can't see how I can enforce the whitelist for anonymous users, whilst allowing any authenticated user to access their own profile page on the URL /user
.
Should I go through everywhere that we link to /user
(including the menu block) to substitute in the user's profile ID, or is there some more-elegant solution that I'm just not seeing?
All suggestions gratefully received :o)