Hello!
We have been working with modx for the past few weeks and so far we really like it. We are using 1.0.0.
However, we ran into a pretty major issue regarding permissions. It seems that whenever we set a resource to public access ("All Resource Groups"), it can never be changed again.
For example, we create Resource1, add it to a resource group called ResourceGroup1. We link ResourceGroup1 to Usergroup1. We login as admin, or as a member of Usergroup1 with edit permissions, and set the Resource1 to "All Resource Groups", and now all users have access to it. Then we say: "Oops, what the hell was I thinking there?", then login as admin, then put Resource1 back to Resourcegroup1 and click on "Save". I looks like it took, but when we look at the "View Resource Data" page, it is still listed as "Manager Access: Public". I then log in as a user who is not part of usergroup1, and has absolutely no business accessing Resource1, and he is able to maniuplate that document (because it is public).
We have tried this with numerous documents, and numerous times. It is 100% replicable. The out-of-the box pages are a really good example of this, since most are set to "All Resource Groups". They cannot be changed to a new resource group (for example, the home page or the blog page). We can change resource groups just fine between any resource group we create, but once it goes to public -- it stays public forever.
We are running modx Evolution 1.0.0 on a Linux server with apache 2.2.11, php-5.2.9-r2 and mysql-5.0.70-r1.
Thank you.
Chris
Did you log out of the Manager before testing?
Did you empty the site cache and browser cache/cookies before testing?
Those can make it seem like a change "didn’t take."
Ok...
I think I got it. I had a resource group not linked to a user group... which I guess modx took to mean that it was publicly accessible. Once I linked that RG to UG, it seemed to work, more or less.
But there is still is strangeness. If I have a resource linked to RG1, then change it to RG2 (taking care to uncheck RG1), I click save, go back and look, and it has both RG1 and RG2 checked. I even cleared my cache, and this was still true. The only way I could get it to stop doing that was to switch from RG1 -> All Resource Groups -> RG2. That seemed to clear-out the unwanted check once and for all. Can anyone else replicate that? It does it on Firefox and Opera (not that that should make a difference...). I can see that becoming a serious security problem down the line.
