My most important category has completely disappeared from manager

No joke.

I have a category called "www", which contains virtually all of the essential chunks, templates, etc. for our primary site design.

I realized about 30 minutes ago that I can’t see the category, or any of the elements in the category, at all.

The category and all elements are still in the database. And I can view resources that use templates in that category. The resources themselves are working fine.

I just can’t see (and hence can’t work with), my elements.

I tried renaming the category in the db, and also removing the parent category. Neither worked. Tried refreshing and logging in/out of Manager, to no avail.

If I take a template out of that category in the db (set category to 0), I can see it in my elements tree.

No idea how to proceed with troubleshooting this.

Have you been playing with MODx permissions? It’s pretty easy to lock yourself out of a set of elements when you create an ACL entry for a user group that’s tied to that category.

Renaming the category won’t help because MODx knows them by their ID numbers.

I did do a little bit of playing with permissions on Wednesday, but not with my admin user (whom I’m logged in as today) or Administrator group. I also haven’t set up any access policies whatsoever on elements/categories; that is new in RC-2, isn’t it?

Quote from: jrotering at Jun 04, 2010, 04:23 PM

I did do a little bit of playing with permissions on Wednesday, but not with my admin user (whom I’m logged in as today) or Administrator group. I also haven’t set up any access policies whatsoever on elements/categories; that is new in RC-2, isn’t it?

Yes it is new in RC2.

I can’t imagine why you can’t see them. No permissions are added by default to the Categories. Have you logged out and back in or purposely flushed your permissions/sessions? I’ll do some more testing here on some older sites and see if I can reproduce the problem.

Um... so it turns out I did play around with element category access permissions after all. On Wednesday I was in the access controls area, noticed the element category access tab for the first time, and evidently I engaged in what we in our office like to refer to as "indiscriminate messing around". I must have granted a certain user group access to this particular category, just to see what would happen.

Then I didn’t notice anything, went home, and a major family medical emergency took up the next 36 hours of my life, causing me to forget having ever done this.

This sequence of events led to my mystical discovery today of my category having vanished, and my confidence that it couldn’t possibly have been due to anything I had done because I hadn’t done anything.

Snooping through the db I found the modx_access_category table tonight, with a record that had a number in it that matched my missing category.

I verified that this was indeed valid evidence by adding a few more element category policies and watching them show up in the table.

Darned if I didn’t see a category disappear right before my eyes when I set up a policy w/ that category + a different user group + manager context!

Dangerous stuff, this Indiscriminate Messing Around...

I deleted all the records from the table, and of course now I’m back in business.

On the bright side, I’m now extremely confident that I’ll be able to hide my precious elements from my dangerous users. (Including, evidently, my most dangerous user... me )

I’m glad you got it worked out.

For others with a similar problem: When you connect a category containing elements to a user group, it "protects" those elements from everyone else. If the Super Admin is not a member of the user group, he or she loses access to those elements too. To regain access, you can either add the admin Super User to the user group, or update the Administrator user group and add an Element Category Access ACL there for the category.

Great tip! Bookmarked.

To regain access, you can either add the admin Super User to the user group, or update the Administrator user group and add an Element Category Access ACL there for the category.

I’m pretty sure the second option won’t work, because when you go to add an Element Category Access ACL to the Admin group, the missing category doesn’t even show up in the dropdown list! I’d say either add the admin to the user group, or whack the ACL from the database and start over.

Perhaps this could be considered a design flaw in a sense... shouldn’t the admin Super User at least have the rights to assign himself rights to an element category, even in this scenario?

Quote from: jrotering at Jun 05, 2010, 01:45 PM

To regain access, you can either add the admin Super User to the user group, or update the Administrator user group and add an Element Category Access ACL there for the category.

I’m pretty sure the second option won’t work, because when you go to add an Element Category Access ACL to the Admin group, the missing category doesn’t even show up in the dropdown list! I’d say either add the admin to the user group, or whack the ACL from the database and start over.

Perhaps this could be considered a design flaw in a sense... shouldn’t the admin Super User at least have the rights to assign himself rights to an element category, even in this scenario?

Good point.

I think the intention, which is not conveyed anywhere, is that when designing a security scheme for a site, that you should first and foremost initiate "restrictions" for a specific object and at the same time give your Administrator group Super User members full permissions to the object you want to "secure". This is what the default Policies included would be used to accomplish. Then you would create your "restricted" Policies with fewer permissions than the default ones and apply those to the objects for your other User Groups (or lesser Members of the Administrators group for that matter; that’s what the Authority/User Group Roles are for). Remember, no object is "restricted" for anyone until one or more Policies are applied to that target object.

If you have any thoughts on how this could be improved (other than by better documenting the above points), I’d love to hear them.

Quote from: jrotering at Jun 05, 2010, 01:45 PM

To regain access, you can either add the admin Super User to the user group, or update the Administrator user group and add an Element Category Access ACL there for the category.

I’m pretty sure the second option won’t work, because when you go to add an Element Category Access ACL to the Admin group, the missing category doesn’t even show up in the dropdown list! I’d say either add the admin to the user group, or whack the ACL from the database and start over.

Perhaps this could be considered a design flaw in a sense... shouldn’t the admin Super User at least have the rights to assign himself rights to an element category, even in this scenario?

Right. Sorry, I should have said that you need to do the second one *before* you restrict access to the category.

Personally, I’ve argued for giving the admin Super User all rights all the time, except when previewing the front end (IOW, taking the term "Super User" literally ). It’s too easy to accidentally cut of the admin’s right to change security settings, see resources and elements, and even log in.