{"record":{"id":"b2ef1fad02395138","repo":"Dolibarr/dolibarr","slug":"sorry-your-application-is-offline-only-administrator-users","errorCode":null,"errorMessage":"Sorry, your application is offline. Only administrator users (${MAIN_ONLY_LOGIN_ALLOWED}) is allowed to connect for the moment.","messagePattern":"Sorry, your application is offline\\. Only administrator users \\((.+?)\\) is allowed to connect for the moment\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"htdocs/main.inc.php","lineNumber":197,"sourceCode":"\tif ((!session_id() || !isset($_SESSION[\"dol_login\"])) && !isset($_POST[\"username\"]) && !empty($_SERVER[\"GATEWAY_INTERFACE\"])) {\n\t\t$ok = 1; // We let working pages if not logged and inside a web browser (login form, to allow login by admin)\n\t} elseif (isset($_POST[\"username\"]) && in_array($_POST[\"username\"], explode(';', getDolGlobalString('MAIN_ONLY_LOGIN_ALLOWED')))) {\n\t\t$ok = 1; // We let working pages that is a login submission (login submit, to allow login by admin)\n\t} elseif (defined('NOREQUIREDB')) {\n\t\t$ok = 1; // We let working pages that don't need database access (xxx.css.php)\n\t} elseif (defined('EVEN_IF_ONLY_LOGIN_ALLOWED')) {\n\t\t$ok = 1; // We let working pages that ask to work even if only login enabled (logout.php)\n\t} elseif (session_id() && isset($_SESSION[\"dol_login\"]) && in_array($_SESSION[\"dol_login\"], explode(';', getDolGlobalString('MAIN_ONLY_LOGIN_ALLOWED')))) {\n\t\t$ok = 1; // We let working if user is allowed admin\n\t}\n\tif (!$ok) {\n\t\tif (session_id() && isset($_SESSION[\"dol_login\"]) && !in_array($_SESSION[\"dol_login\"], explode(';', getDolGlobalString('MAIN_ONLY_LOGIN_ALLOWED')))) {\n\t\t\tprint 'Sorry, your application is offline.'.\"\\n\";\n\t\t\tprint 'You are logged with user \"'.$_SESSION[\"dol_login\"].'\" and only administrator users (' . str_replace(';', ', ', getDolGlobalString('MAIN_ONLY_LOGIN_ALLOWED')).') is allowed to connect for the moment.'.\"\\n\";\n\t\t\t$nexturl = dolBuildUrl(DOL_URL_ROOT . '/user/logout.php', [], true);\n\t\t\tprint 'Please try later or <a href=\"'.$nexturl.'\">click here to disconnect and change login user</a>...'.\"\\n\";\n\t\t} else {\n\t\t\tprint 'Sorry, your application is offline. Only administrator users (' . str_replace(';', ', ', getDolGlobalString('MAIN_ONLY_LOGIN_ALLOWED')).') is allowed to connect for the moment.'.\"\\n\";\n\t\t\t$nexturl = dolBuildUrl(DOL_URL_ROOT . '/');\n\t\t\tprint 'Please try later or <a href=\"'.$nexturl.'\">click here to change login user</a>...'.\"\\n\";\n\t\t}\n\t\texit;\n\t}\n}\n\n\n// Activate end of page function\nregister_shutdown_function('dol_shutdown');\n\n// Load debugbar\nif (isModEnabled('debugbar') && !GETPOST('dol_use_jmobile') && empty($_SESSION['dol_use_jmobile'])) {\n\tglobal $debugbar;\n\tinclude_once DOL_DOCUMENT_ROOT.'/debugbar/class/DebugBar.php';\n\t$debugbar = new DolibarrDebugBar();\n\t$renderer = $debugbar->getJavascriptRenderer();\n\tif (!getDolGlobalString('MAIN_HTML_HEADER')) {","sourceCodeStart":179,"sourceCodeEnd":215,"githubUrl":"https://github.com/Dolibarr/dolibarr/blob/598aa4bdada683d17ca04b1842548821ff0eb6c6/htdocs/main.inc.php#L179-L215","documentation":"Same maintenance restriction, but reached when the request has no session at all (e.g. API clients, new visitors). Dolibarr prints that only administrator users from MAIN_ONLY_LOGIN_ALLOWED may connect, with a link to the login page.","triggerScenarios":"MAIN_ONLY_LOGIN_ALLOWED set; request without a dol_login session (fresh visitor, REST client, cron using a non-allowed account).","commonSituations":"Monitoring/health checks hitting pages during maintenance; API integrations broken while MAIN_ONLY_LOGIN_ALLOWED is enabled; forgotten maintenance flag after upgrade.","solutions":["Clear MAIN_ONLY_LOGIN_ALLOWED after maintenance completes","Use an allowed admin login for programmatic access","For bots/health checks, exempt them or point them at a page that defines NOLOGIN/NOREQUIREUSER consistently"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Monitor the flag MAIN_ONLY_LOGIN_ALLOWED so it isn't forgotten","Use a dedicated admin account for API access during maintenance windows","Point health checks at endpoints that bypass the restriction legitimately"],"tags":["dolibarr","maintenance-mode","access-control"],"backgroundTag":"permission-denied","analyzedSha":"598aa4bdada683d17ca04b1842548821ff0eb6c6","analyzedAt":"2026-09-14T11:12:15.309Z","contentChangedAt":"2026-09-14T11:12:15.309Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}