We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 26657
    • 13 Posts
    Hi,

    I am working on a plugin that writes the sitestructure and some contents and TVs into an XML-File to serve a Flash site with content. This is working fine. But then i created a manager user for my Customer. This manager user does not have access to the Documents in the site root as they define the basic sitestructure - this documents belong to a documentgroup this user does not have access to (i want to prevent my customer from destroing the hole site by deleting for example the "portfolio"-folder - i call this folder in the plugin by its ID). The plugin is working fine as long as i am locked in as the standard admin user, but if i am locked in as this manager user the plugin can not access documents from other documentgroups. I use this call for example:
    $folderID = 5; //my admin user does not have access to the documentgroup this document belongs to
    $myVar = $modx->getDocumentChildren($folderID,1,0,$fields='id, pagetitle, content, menuindex',"","menuindex","asc");

    Is there a way to execute the plugin with admin privileges or is there an other solution?
    I hope someone can point me to the right direction.

    Thanks in advance
      • 27376
      • 576 Posts
      Any solution would require hacking the core because [tt]getDocumentChildren()[/tt] is hardcoded to only return documents the current user has access to.

      You could however make your own copy of the function and remove the user access privileges logic. Keep in mind though that this would be considered a security risk.
        • 26657
        • 13 Posts
        Instead of removing the access privileges I added this:

         OR sc.privatemgr=3


        It’s working as required. I hope the security risk is acceptable this way.

        Good Tip - Thanks a lot.
          • 22303 MODX Staff
          • 10,725 Posts
          I don’t recommend that as a solution. I think you’ll find there are several things in the manager which will "reset" the value of privateweb (when adding/removing a document to a document group, refreshing the cache, etc.) via compulsory UPDATE statements. It’s also supposed to be a boolean value (i.e. 1 or 0 are the only valid values).
            • 26657
            • 13 Posts
            Ah, ok. I thought it defines the manager role id.
            Would it then be appropriate to delete the following line from the database call?

            AND ($access)

            Sorry for the stupid questions, but I’m not a developer at all.