Revolution Security Use Cases

Here’s another one:

look at the Resources-tab at the left. You’ve got icons above the tree for creating a new Document, Weblink, Symlink and Static Resource. I want to be able to remove the ability for clients to create a new Weblink, Symlink and Static Resource. In simpler terms: how can I get rid of those extra icons?

Quote from: Martijn at May 19, 2011, 02:23 PM

look at the Resources-tab at the left. You’ve got icons above the tree for creating a new Document, Weblink, Symlink and Static Resource. I want to be able to remove the ability for clients to create a new Weblink, Symlink and Static Resource. In simpler terms: how can I get rid of those extra icons?

Today is Feature Request day for Martin. You cannot, at this time, restrict creation of derivative Resource types. That would be a great feature request for 2.2.

Quote from: TomMLS at May 19, 2011, 02:32 PM

I want to give them a subset of documents they can edit and I figured this out with BobRay’s tutorial, which I thought could be simpler, it would be good for MODx to document this with several examples, people have a better chance of figuring it out with multiple explanations and examples.

This tutorial does a pretty good job of that: http://rtfm.modx.com/display/revolution20/Making+Member-Only+Pages

I’d like to see being able to create different user groups on the same site with different sets of documents they can work on/edit.

See above link.

What about user groups that are a subset of another user group, wherein the subsetted groups has fewer or more rights??

User Group Inheritance is not currently a feature in MODX Revolution; it is on the Roadmap, however.

The documentation should follow Carlo’s tweet:
@splittingred from a forum thread I was thinking on someth like this but for each user: starting context->user groups->resource groups #modx

Actually, the best way to do Security in MODX is to start by creating a list of Policies you want to have - basically, make a collection of Policies that have the right sets of Permissions, and then all you have to do is add ACL records for the User Groups you want.

Quote from: TomMLS at May 19, 2011, 02:54 PM

Then one could do this by creating separate groups etc.??

Yes.

As to member-only pages...it looks like that tutorial is for the web side only. It should teach how to do this for manager side too??

Sure, it could be expanded. Basically all you need to do though is change the Context in the ACL entry in step 4 from ’web’ to ’mgr’, and put that on the Administrator User Group (rather than the Editors or whatever user group).