We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 17838
    • 82 Posts
    Hello,

    I’ve just been introduced to MODx Revolution. I had to change to it from Evo because I need to build simple manager on top of MODx for "webusers" to allow them (in the scope of specified group/role) editing and adding other users (without permisson to edit "mangers" of course), add and edit snippets or even add documents.

    I’m getting acquainted with connectors and processors stuff. I would like to use this mechanism as I might be using AJAX. But as I see: only manager can have access to connectors/processors that are about to do managment functions.

    I see there are roles, contexts, policies, access permissions but for now I don’t understand those dependencies.
    I just wanted to have a quickstart. What should I look for and where: which files, options, etc.?

    What should I setup in manager to do stuff: allow some of "webusers" to do managment&content editing stuff a still don’t give them access to /manager/?

    I would be grateful for any tips.

    --
    Regards
    MM

      • 17838
      • 82 Posts
      Hello,

      When will there be a chapter about security on MODx Revolution Documentation?
      (vide: http://svn.modxcms.com/docs/display/revolution/Context+Permissions)

      --
      Regards
      MM
        • 28215
        • 4,149 Posts
        Quote from: maciej.m at Jun 18, 2009, 09:25 AM

        When will there be a chapter about security on MODx Revolution Documentation?
        (vide: http://svn.modxcms.com/docs/display/revolution/Context+Permissions)

        We are working on security documentation as we speak. It will be through when we finish it; I can’t give you a specific date. The Security system in Revolution is vastly more complex and feature-robust; documentation is taking much more work than 0.9.6.

        Not to mention we still have rent to pay. wink
          shaun mccormick | bigcommerce mgr of software engineering, former modx co-architect | github | splittingred.com
          • 17838
          • 82 Posts
          Thanks for the aswer.

          Though I still have a problem to solve. I’ll ask it in most simple way.

          Requesting
          /connectors/security/user.php?action=getList
          while logged as admin outputs following JSON Object:

          ({"total":"2","results":[{"id":1,"internalKey":1,"fullname":"Default Admin User","role":1,"email":"[email protected]","phone":"","mobilephone":"","blocked":false,"blockeduntil":0,"blockedafter":0,"logincount":16,"lastlogin":1245335496,"thislogin":1245341096,"failedlogincount":0,"sessionid":"f7be67181b3e520baf17c09f4739c595","dob":0,"gender":0,"country":"","state":"","zip":"","fax":"","photo":"","comment":"","username":"admin","password":"f81f1831a743382887e812b61549c745","cachepwd":"","class_key":"modUser","menu":[{"text":"Update User","handler":"this.update"},"-",{"text":"Remove User","handler":"this.remove"}]},
          {"id":2,"internalKey":2,"fullname":"Zbigniew Szaraczek","role":1,"email":"[email protected]","phone":"","mobilephone":"","blocked":false,"blockeduntil":0,"blockedafter":0,"logincount":8,"lastlogin":1245334410,"thislogin":1245335807,"failedlogincount":0,"sessionid":"785643f079c0b2cd39cf968d3cd6fa12","dob":0,"gender":0,"country":"0","state":"","zip":"","fax":"","photo":"","comment":"","username":"szaraczek","password":"f81f1831a743382887e812b61549c745","cachepwd":"","class_key":"modUser","menu":[{"text":"Update User","handler":"this.update"},"-",{"text":"Remove User","handler":"this.remove"}]}]})


          while being logged as "szaraczek" user outputs:
          {"success":false,"message":"Permission denied!","total":0,"data":[],"object":[]}


          I want to give to "szaraczek" user permission to view, edit, add, delete users same as admin has.
          In other words I want f.e. that if someone is logged as "szaraczek" user and "opens" (AJAX request)
          /connectors/security/user.php?action=getList the full JSON object with all users should be outputted.

          Could it be done just with existing security system. How to set up "szaraczek" permissions, contexts

          Will be veery, very grateful for help