I've used the excellent plugin provided here
http://modxcookbook.com/security/users/get-user-group.html as a starting point, but I need help finding a solution that doesn't involve modifying core files.
I have a fairly complex set of user ACLs covering 10 contexts. I want to limit the users shown in the Manage/Users grid to users that are members of the same groups as the current manager user. I've gotten this to work fine by modifying core/model/modx/processors/security/users/getlist.class.php but obviously that's NOT a long-term solution, and is a bad idea in general, so I'm wondering if anybody has advice on what a viable path might be for this. Am I looking at a CMP, or is there a way to accomplish this same basic approach via a plugin?
Here's what I'm doing. I'm running the following plugin to pass either the user's primary group, or, if they're a member of multiple groups, an array of group IDs:
if ($modx->context->get('key') == "mgr") {
if ($modx->user->get('sudo')) { return; }
switch ($modx->event->name) {
case 'OnMODXInit':
$action = $modx->getOption('action', $_REQUEST, '');
if ($action == 'security/user/getList') {
$groups = $modx->user->getUserGroups();
if (count($groups) > 1){
$g = $groups;
}else{
$group = $modx->user->getPrimaryGroup();
$g = $group->get('id');
}
if (empty($_POST['usergroup'])){
$_POST['usergroup'] = $g;
}else{
if (!in_array($_POST['usergroup'],$groups)){
$_POST['usergroup'] = $groups;
}
}
}
break;
}
}
return;
Then I modified core/model/modx/processors/security/users/getlist.class.php, starting at line 46, to include the following:
if (!empty($userGroup)) {
if (is_array($userGroup)){
$c->distinct();
$c->innerJoin('modUserGroupMember','UserGroupMembers');
$c->where(array(
'UserGroupMembers.user_group:IN' => $userGroup,
));
}else{
if ($userGroup === 'anonymous') {
$c->join('modUserGroupMember','UserGroupMembers', 'LEFT OUTER JOIN');
$c->where(array(
'UserGroupMembers.user_group' => NULL,
));
} else {
$c->distinct();
$c->innerJoin('modUserGroupMember','UserGroupMembers');
$c->where(array(
'UserGroupMembers.user_group' => $userGroup,
));
}
}
This determines if the value passed in POST is an array of group IDs and adjusts the query accordingly. The result is that I get a list of all the users in the current user's groups and deny them access to any other groups (like administrators). This is the result I want, but not the method. Ideally it would be great to limit the drop-down group list to this same selection of groups, but I haven't located where that's coming from yet. Honestly, this seems like a somewhat necessary functionality, so I'm wondering why MODX doesn't have a mothod for this already, or maybe we do and I've completely missed it.
Any advice would be more than welcome.
