Uh oh.
Jared’s posting about this dumb permissions thing again.
Man he won’t leave it alone! He just keeps going
on and
on about it.
Shut up man!!
I promise guys...
this time is different!
So I do some testing on 0.9.5 and now 0.9.6 RC1 to see if managers are denied unless allowed yet. Nope. They’re not. So finally I start thinking, was this EVER the case? So I go to my production site and test. Nope. Apparently not. Doh!
<sound type="headBangingOnWall" />
OK, so not upgrading because permissions "changed" turns out to be a red herring. So what can be done to fix the problem? I went on a search. Turns out the permissions is done in:
manager/processors/user_docouments_permissions.class.php
In this bit of SQL:
$tblsc = $dbase.".`".$table_prefix."site_content`";
$tbldg = $dbase.".`".$table_prefix."document_groups`";
$tbldgn = $dbase.".`".$table_prefix."documentgroup_names`";
$sql = "SELECT DISTINCT sc.id
FROM $tblsc sc
LEFT JOIN $tbldg dg on dg.document = sc.id
LEFT JOIN $tbldgn dgn ON dgn.id = dg.document_group
WHERE sc.id = $document
AND (1='' OR NOT(dgn.private_memgroup<=>1)".(!$docgrp ? "":" OR dg.document_group IN ($docgrp)").");";
// ^ MySQL 4.1 will not return the correct result if this statement is removed! ???
$rs = mysql_query($sql);
$limit = mysql_num_rows($rs);
if($limit==1) $permissionsok = true;
So I start trying to figure out what it’s doing... hey wait... we don’t even need the site_content table referenced (because the site_content.id field IS THE SAME DATA as document_groups.document. So I trim... then wait... do we really even need to check the documentgroup_names table? As far as I can tell, the private_memgroup fields don’t get used anyway, or even if they do, the needn’t be if we go with a deny unless allowed philosophy. So I tried this shorter but more white spaced (sue me) code in its place:
// Manager logic
if ( $_SESSION['mgrDocgroups'] )
{
$tbldg = $dbase.".`".$table_prefix."document_groups`";
$sql = "
SELECT DISTINCT
dg.document
FROM
$tbldg AS dg
WHERE
dg.document = $document
AND
dg.document_group IN ($docgrp)";
$rs = mysql_query($sql);
$qty = mysql_num_rows($rs);
if ( 1 == $qty ) $permissionsok = TRUE;
}
I made a "manager logic" section not knowing if I’d have to distinguish between manager users and web users. But after trying it out, this code actually seems to work well. A manager user is indeed denied unless specifically allowed. AND, as far as I can tell, it didn’t mess with the webuser perms at all!
So I’m tossing this out there because I’ve not been in the game much lately, and want to check with you folks to see if there’s some reason this won’t be good.
Shutting up now.
MODX Staff
☆ A M B ☆
