We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 7455
    • 2,204 Posts
    mm there is another problem:

    i use the context menu by clicking on a folder that I have no rights to and select "create doc here" and then i can fill my page etc on saving I get an error saying that I am not allowed to save the page in that folder, so I select a folder my opening the icon (parent) and selecting a folder that I am allowed to add documents to and press save. now my document is saved in my folder but it has the rights of the folder that i clicked the first time to add a document.

    I do not have a fix for that yet because its a whole new bug, I have no idea if that bug is in Jira already because Jira is down
      follow me on twitter: @dimmy01
      • 7455
      • 2,204 Posts
      ok I added some stuff to: mutate_content.dynamic.php from line 1050

      if ($use_udperms == 1) {
          $groupsarray = array ();
      
          if ($_REQUEST['a'] == '27') { // fetch permissions on the document from the database
              $sql = "SELECT * FROM $dbase.`" . $table_prefix . "document_groups` where document=" . $id;
          $rs = mysql_query($sql);
          $limit = mysql_num_rows($rs);
          for ($i = 0; $i < $limit; $i++) {
                  $currentgroup = mysql_fetch_assoc($rs);
              $groupsarray[$i] = $currentgroup['document_group'];
          }
      } else { // set permissions on the document based on the permissions of the parent document changed by dimmy so that if you are not in to one of the groups than your groups are added.
              if ($_SESSION['mgrDocgroups']) {
                 if(is_array($_SESSION['mgrDocgroups'])){ $groupsarray = $_SESSION['mgrDocgroups'];}else{$groupsarray[0] = $_SESSION['mgrDocgroups'];}
              }
              
              if (!empty ($_REQUEST['pid'])) {
                  $sql = "SELECT * FROM $dbase.`" . $table_prefix . "document_groups` where document=" . $_REQUEST['pid'];
              $rs = mysql_query($sql);
              $limit = mysql_num_rows($rs);
              for ($i = 0; $i < $limit; $i++) {
                      $currentgroup = mysql_fetch_assoc($rs);
                  $groupsarray[$i] = $currentgroup['document_group'];
              }
          }
      }
      

      this way the docgroups that you have permisions to are added to that document BUT that is not a good fix better would be that the docs are all cleared and that only the groups of the new parent is used (the check if you are part of that docgroup is already working)

      I will see if I can see if I can find that part (probebly $_POST[’parent’])?

      will come back to this topic.

      Dimmy
        follow me on twitter: @dimmy01
        • 7455
        • 2,204 Posts
        Man this is harder that i think it was.

        the new parent is trigerd on save not on setting the values for the current doc.
        so the above does work but would add the new page to all docgroups the current user belogs to...
        so this must be alterd maybe on saving the document?

        could someone with some more php and modx core knolige have a look at this problem?

        the main problem is that a newly created document that is triggerd from a context menu on a document that is not in the docgroup of the user gets he same docgroups as the forbidden document, when saving this document to a folder that the user has acces to the document will be saved but inaccesible to the user because the new document is not in the docgroup of the new document.

        maybe when wanting to create a new document when clicking a forbidden documents context menu there must be a restrictionwarning and document can not be made.

        better would be that on saving a new document that there is a check in what folder the new doc is placed and take the docgroups from that parent.

        I hope that its a bit clear what i mean, sorry for the long story.

        Dimmy


          follow me on twitter: @dimmy01
        • Hi Dimmy, can you open an issue in Jira for this please?
            Ryan Thrash, MODX Co-Founder
            Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
            • 7455
            • 2,204 Posts
            Quote from: rthrash at Oct 01, 2008, 06:09 PM

            Hi Dimmy, can you open an issue in Jira for this please?

            Done
              follow me on twitter: @dimmy01
            • For reference, here’s the bug: http://svn.modxcms.com/jira/browse/MODX-397

                Ryan Thrash, MODX Co-Founder
                Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me