ETL website launched!
We finally launched the ETL website. Yesterday I spent some time trying to secure the website. We decided not to allow new members to sign up, and to have all authenticated users work on a secure connection.
We used a wildcard SSL certificate to set up secure sockets with apache and redirect all authenticated requests to https. Here’s a great howto on how to do this.
However for Plone 2.1, modifying the logged_in script no longer works. Instead go to /portal_skins/plone_login/login_next
came_from = REQUEST.get('came_from', None)
Add the following:
if came_from.split(':')[0]=='http':
came_from = came_from.replace('http:','https:')
I also disabled the join link since we don’t want new users to register. To do this go to /portal_registration on the ZMI, and then uncheck the visible checkbox of the join action.
Then go to / and click the security tab, and look for the Add Portal Member permission. Uncheck acquire and make sure that only Manager is checked in that row. That way only managers can add new users.