I totally failed to get an ’editor’ permissions working at all. Whatever access policy I used, an editor could see everything and do anything.
I noticed some time ago that I didn’t ’own’ the files for some of the add ons - Tinymce, Formit, Wayfinder & getResource, but they worked OK. A few days ago, I got round to tidying up and asked the server to change the ownership of these files and hey presto, suddenly the editor permissions worked.
I also had a problem with Quip not listing comments in the back end - one of the Quip folder permissions was 777 instead of 755. Changing this solved that problem.
So the moral of this story is: if anything doesn’t work as you think it should, check the ownership and permissions of your files!
Did you get error messages in the MODx error log when the permissions weren’t working?
My guess is that you weren’t able to clear the cache or flush permissions because of the file ownership/permissions, so none of your changes "took."
No error messages in the Modx log and flushing permissions etc seemed to work at the time. Clearing cache definitely worked - I had previously asked the server to change the owner of the cache folder, not noticing until some time later it was also wrong on the add ons. I had originally installed Modx in a test area and not known that the file ownership would be different when it went live. I ended up re-installing Modx, but not the add ons.
There was an error about the folder permissions in the server log, which was how I found out how to solve the Quip problem.
Another idiot here. I’ve got a user who can login and see a very minimalist version of the manager. The resources tab is visible, but no resources are displayed. I’ve tried this about twelve times. I was reasonably confident I’m not a complete moron, but now I’m not so sure.
I have a User Group called Editor Admin and a User called test. I have put all the resources I want editable by test into a Resource Group called All Content. Test has a Role of Content Editor (Authority 1)
Security > Mange Users >
[tt]User: test: "Access Permissions" tab:[/tt]
User Group: Editor Admin
Role: Content Editor
Security > Access Controls >
[tt]User Group: Editor Admin: "Users" tab:[/tt]
username: test
role: Content Editor
[tt]User Group: Editor Admin: "Context Access" tab:[/tt]
Context: mgr
Minimum Role: Content Editor - 1
Access Policy: Content Editor
[tt]User Group: Editor Admin: "Resource Group Access" tab:[/tt]
Resource Group: All Content
Minimum Role: Content Editor - 1
Access Policy: Resource
Context: mgr
When logged in test can see the Resource tab but no resources. Please tell me what I have done wrong, I’ve already spent a couple hours trying to make this work with no success.
Add this:
User Group: Editor Admin: "Context Access" tab:
Context: web
Minimum Role: Content Editor - 1
Access Policy: Content Editor
It’s kind of counterintuitive, since ’web’ usually refers to the front end, but if you don’t give the user access to the ’web’ context, they can’t see anything in the ’web’ part of the tree in the Manager.
OK... That makes it visible, thank you. But something is still not clicking. test can view and edit resources that aren’t in the All Content resource group.
Quote from: nsfdev at Feb 21, 2011, 10:54 PM
OK... That makes it visible, thank you. But something is still not clicking. test can view and edit resources that aren’t in the All Content resource group.
Unfortunately, you need to put all those other resources in another resource group and connect them to the Administrators group with an authority level of 0 in order to protect them (context of ’mgr’). Resources that aren’t protected in this way are available for everyone.
You may be able to take a shortcut. If you protect a container resource that way, it’s children won’t show in the tree for the editors (though the children aren’t truly protected since the Editors can edit the URL and edit them if they can guess the IDs).
Thanks. That’s a bit counter intuitive, but OK.
Is it possible to bundle this as a package? I can see how this level of control could be useful on a company intranet or something, but on the vast majority of sites I build, there are only ever a handful of users at any given time. A dumbed down blank package containing pre-configured User Groups, Resource Groups, and Roles would be really useful. All three would be sync’d -- literally, if possible. Just create a new user and give her a role, she’ll be in the right group and it will have access to the right resource by default. At that point, the person putting together the site simply has to remember to assign resources to the appropriate resource groups and users to the appropriate role, and if they need to add a junior editor role to the editor group, they can still do that.
Most things in Revo seem extractable. Is this?
I don’t see how, because the resources you need to protect wouldn’t exist yet, and even if they did, there’s be no way to know which resources they were.
It would be possible to create a package that protected all current resources on the site and installed a plugin that would protect all new resources by adding them to the protected resource group, but you’d still have to manually put new resources for the editors into the resource group they can access (though you could modify the plugin to do that automatically based on some characteristic like their parent, pagetitle, or template). I don’t see a generic solution for this, though.
You could certainly package up a given set of resources and assign them to the appropriate groups, but again, not a generic solution.
