MODX Staff
Just for further clarification, removing the Context access from the Admin group will not remove access unless you have protected the web context with a Context policy assigned to another Group.
A word of warning:
While playing around with permissions in Revolution, I deleted the admin’s access to the web context in a moment of overwhelming stupidity.
That gave me an empty Resources Tree and no way to get the Web context access back short of editing the modx_context_access table in the DB.
☆ A M B ☆
It may prove beneficial to create a "default" group under the admin for the documents and leave the admin alone -- even for users who will have admin access.
You may want to add exactly what you changed in the database for the next guy (probably me) who will do this...
Just for further clarification, removing the Context access from the Admin group will not remove access unless you have protected the web context with a Context policy assigned to another Group.
MODX Staff
Resource Group ACL’s won’t affect this, so I don’t think your "Public" Resource Group had anything to do with this. Context ACL’s would be the only way you would have lost access. If there is a Context ACL assigned to the web context for some group other than Administrators, and you remove the one for the Administrators group, the Administrators will no longer be able to "load" that Context at all, anywhere. Remember, Context ACLs protect both the Context objects they are assigned to (load, remove, save) as well as permissions to perform content management activities (i.e. execute the core processors) from within that Context. Resource Group ACLs only affect permissions specific to the Resources in a Resource Group from within a specified Context.
Quote from: OpenGeek at Dec 22, 2009, 12:51 PM
Just for further clarification, removing the Context access from the Admin group will not remove access unless you have protected the web context with a Context policy assigned to another Group.
I did have a "Public" resource group containing all documents with an access policy for the Web context. Could I have recovered by deleting that ACL entry or by adding the admin to a user group with access to that resource group and authority 0?
Why would that resource group assignment keep the web context from showing up in other places? The first thing I tried was to update the Admin user group to add access to the Web context, but it didn’t show up in the dropdown.
MODX Staff
No strategy at the current time, though I’ve been considering making the default Administrators UserGroup, default admin User account, the default Policies/Permissions, and the default modAccessContext records read-only in some way (i.e. you have to unlock it and be presented with a warning in order to modify those records in any way).
Is there a general strategy for avoiding this situation (i.e. is it practical to have no web context access in user groups), or does it just come with the territory?