The whole user_documents_permissions.class.php class was not working correct it would alway return true for (as far as I can see) 2 bugs in that script.
Resulting in the bug that even if you are not alowed to edit a page that you are alowed to delete, move, publish, unpublish etc
I found this bug wile working with Maxigallery that showed the managepictures button to manager users taht where not alowed to edit the page.
first this line (33):
if($GLOBALS['use_udperms']==0 || $GLOBALS['use_udperms']=="" || !isset($GLOBALS['use_udperms'])) {
return true; // permissions aren't in use
}
this will always return true because $GLOBALS[’use_udperms’] does not exist it must be $modx->config[’use_udperms’], like this:
if($modx->config['use_udperms']==0 || $modx->config['use_udperms']=="" || !isset($modx->config['use_udperms'])) {
return true; // permissions aren't in use
}
these line must be changed also for the last part to work right:
from:
if($_SESSION['mgrDocgroups']) {
$docgrp = implode(",",$_SESSION['mgrDocgroups']);
}
to:
if($_SESSION['mgrDocgroups']) {
$docgrp = implode(" || dg.document_group = ",$_SESSION['mgrDocgroups']);
}
this comes in to play when more then one docgroup is asigned to a user
the last problem is the last db query that somhow always ended up being 1 also always returned true:
$tblsc = $dbase.".`".$table_prefix."site_content`";
$tbldg = $dbase.".`".$table_prefix."document_groups`";
$tbldgn = $dbase.".`".$table_prefix."documentgroup_names`";
$sql = "SELECT DISTINCT sc.id
FROM $tblsc sc
LEFT JOIN $tbldg dg on dg.document = sc.id
LEFT JOIN $tbldgn dgn ON dgn.id = dg.document_group
WHERE sc.id = $document
AND (1='' OR NOT(dgn.private_memgroup<=>1)".(!$docgrp ? "":" OR dg.document_group IN ($docgrp)").");";
// ^ MySQL 4.1 will not return the correct result if this statement is removed! ???
$rs = mysql_query($sql);
$limit = mysql_num_rows($rs);
this should be in my opinion this:
$tblsc = $dbase.".`".$table_prefix."site_content`";
$tbldg = $dbase.".`".$table_prefix."document_groups`";
$tbldgn = $dbase.".`".$table_prefix."documentgroup_names`";
$sql = "SELECT DISTINCT sc.id
FROM $tblsc sc
LEFT JOIN $tbldg dg on dg.document = sc.id
LEFT JOIN $tbldgn dgn ON dgn.id = dg.document_group
WHERE sc.id = $document
AND (dg.document_group = $docgrp || sc.privatemgr = 0)";
$rs = mysql_query($sql);
$limit = mysql_num_rows($rs);
in my config it works great now.
this bug is in all versions from 091 as far as I can see also in the new version
Greets Dimmy
fixed a nothe bug in my fix... (when does the hurting stop!)
MODX Staff
I’ll test the fixes out and we should make sure that these definitely make it into the pending 0.9.6.3 release (can’t do much until the MODx SVN server comes back online)
☆ A M B ☆
