We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 11055 ☆ A M B ☆
    • 3,112 Posts
    I want to add a patch, which is can not be done unless I do it in the core.
    Manager Access to "Container" document, or folder access.
    Just to make my purpose understandable:

    [table]
    [tr]
    [td]Container[/td]
    [td]Resource[/td]
    [td]Accessibility[/td]
    [/tr]
    [tr]
    [td]X[/td]
    [td]X[/td]
    [td]Complete restricted[/td]
    [/tr]
    [tr]
    [td]X[/td]
    [td]V[/td]
    [td]Only per individual resource You can change the parent’s content as a common resource, but can not access the children unless you have their permissions or they don’t have permission (resource default)[/td]
    [/tr]
    [tr]
    [td]V[/td]
    [td]X[/td]
    [td]Only per individual parent You can access the children, but can not change the parent’s content[/td]
    [/tr]
    [tr]
    [td]V[/td]
    [td]V[/td]
    [td]Parent and children are accessibled (container default).[/td]
    [/tr]
    [/table]

    When Container Access is applied, each of resource will be set up as a container, although it doesn’t have any child at the moment (an empty container).

    Why am I asking? This is a permission core code. I believe the patching submission on this area is very limited.
      Rico
      Genius is one percent inspiration and ninety-nine percent perspiration. Thomas A. Edison
      MODx is great, but knowing how to use it well makes it perfect!

      www.virtudraft.com

      Security, security, security! | Indonesian MODx Forum | MODx Revo's cheatsheets | MODx Evo's cheatsheets

      Author of Easy 2 Gallery 1.4.x, PHPTidy, spieFeed, FileDownload R, Upload To Users CMP, Inherit Template TV, LexRating, ExerPlan, Lingua, virtuNewsletter, Grid Class Key, SmartTag, prevNext

      Maintainter/contributor of Babel

      Because it's hard to follow all topics on the forum, PING ME ON TWITTER @_goldsky if you need my help.
      • 22303 MODX Staff
      • 10,725 Posts
      Anyone can open issues in JIRA and attach patches for any version, but TBH, I have no idea what you just suggested or what it relates to. Would be better to fully describe this and get some input/feedback from the community IMO.
        • 11055 ☆ A M B ☆
        • 3,112 Posts
        Hmm... ok, this is what I’m talking about:

        MODx uses a very simple structure on organizing its documents, using doc-trees.
        Each document (a.k.a. resource) can act as the web page and also as a folder (container) for its child pages.
        So, each of resources has 2 kind of doc-tree’s types: document and folder.
        While MODx provides the document’s permission, it misses the folder’s permission.
        In simple words, it just like having shared/protected folders and also shared/protected files in my computer box.

        In my mind, this permission will allow us to restrict the edit mode to the folder but at another hand can allow people to add children underneath (eg: the folder belongs to Editor-in-Chief, and children belong to editors/authors).
        This disturbed me several times when I gave permission to new editors to create new pages under (protected page) articles/news folders.

        Wait the minute...
        What was the reason that make you guys did NOT create this, anyway?
          Rico
          Genius is one percent inspiration and ninety-nine percent perspiration. Thomas A. Edison
          MODx is great, but knowing how to use it well makes it perfect!

          www.virtudraft.com

          Security, security, security! | Indonesian MODx Forum | MODx Revo's cheatsheets | MODx Evo's cheatsheets

          Author of Easy 2 Gallery 1.4.x, PHPTidy, spieFeed, FileDownload R, Upload To Users CMP, Inherit Template TV, LexRating, ExerPlan, Lingua, virtuNewsletter, Grid Class Key, SmartTag, prevNext

          Maintainter/contributor of Babel

          Because it's hard to follow all topics on the forum, PING ME ON TWITTER @_goldsky if you need my help.
          • 22303 MODX Staff
          • 10,725 Posts
          This is addressed by Revolution’s security system. I think trying to address this in Evo would be foolish at this point, but if someone can design a solution that doesn’t break compatibility...
            • 28042 ☆ A M B ☆
            • 24,524 Posts
            The manager user system is still very much "legacy" from the old pre-MODx Etomite days, when there was no "web user" management system.

            There is a setting in the Configuration to allow all manager users to see all resources, "Show Protected Pages" on the Interface and Features tab, even those they cannot actually access. You can work around the security restrictions by creating a "dummy" resource under the secured container resource, and your users can duplicate those.
              Studying MODX in the desert - http://sottwell.com
              Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
              Join the Slack Community - http://modx.org
              • 28042 ☆ A M B ☆
              • 24,524 Posts
              It’s not difficult to modify the two files required to be able to save a new resource in a protected container where the user does not have permission to edit the container resource. What is the rational for not allowing the creation of new documents under such a container?
                Studying MODX in the desert - http://sottwell.com
                Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
                Join the Slack Community - http://modx.org
                • 25663 MODX Staff
                • 12,272 Posts
                Susan/goldsky I think it’s just a legacy behavior, with no explicit reason to prohibit those actions.
                  Ryan Thrash, MODX Co-Founder
                  Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
                  • 11055 ☆ A M B ☆
                  • 3,112 Posts
                  Quote from: OpenGeek at Apr 27, 2010, 10:22 AM

                  This is addressed by Revolution’s security system. I think trying to address this in Evo would be foolish at this point, but if someone can design a solution that doesn’t break compatibility...
                  Will be awarded a free ticket to MODxpo? grin

                  Quote from: sottwell at Apr 27, 2010, 11:22 AM

                  It’s not difficult to modify the two files required to be able to save a new resource in a protected container where the user does not have permission to edit the container resource.
                  Only two? Which ones?

                  My investigation summed up that the affected files were:

                  • actions/access_permissions.dynamic.php
                  • actions/mutate_content.dynamic.php
                  • includes/secure_mgr_documents.inc.php
                  And an additional field (’private_container’) in these tables:

                  • document_groups
                  • documentgroup_names
                  • site_content

                  For a sneak peak, please see the images.
                  Or do I do it too much?
                    Rico
                    Genius is one percent inspiration and ninety-nine percent perspiration. Thomas A. Edison
                    MODx is great, but knowing how to use it well makes it perfect!

                    www.virtudraft.com

                    Security, security, security! | Indonesian MODx Forum | MODx Revo's cheatsheets | MODx Evo's cheatsheets

                    Author of Easy 2 Gallery 1.4.x, PHPTidy, spieFeed, FileDownload R, Upload To Users CMP, Inherit Template TV, LexRating, ExerPlan, Lingua, virtuNewsletter, Grid Class Key, SmartTag, prevNext

                    Maintainter/contributor of Babel

                    Because it's hard to follow all topics on the forum, PING ME ON TWITTER @_goldsky if you need my help.
                    • 28042 ☆ A M B ☆
                    • 24,524 Posts
                    Well, from what I saw digging around it looked like just a small change to the mutate_content action file, and a more difficult one to the save_content processor.

                    The permission check staring at line 14 of mutate_content changed to
                    	case 4:
                    		if (!$modx->hasPermission('new_document')) {
                    			$e->setError(3);
                    			$e->dumpError();
                    		}
                    		break;
                    

                    takes care of the "can’t do it if the parent doc is secured" problem. This would need to be adjusted some to deal with "can’t add new resources to top-level (parent == 0), but the main idea is here.

                    The saving part comes in a block starting on line 252; it needs to be modified to only block if $actionToTake == ’edit’ or $udperms->document (the parent ID) == 0 and the user can’t put new resources in the root.

                    I didn’t really go into that, as I was uncertain as to why this blanket prohibition on putting new content in a protected container was set up in the first place; I may be missing something crucial here.

                    Anyway, changing those two files should open up the "new" option even if the container is protected.
                      Studying MODX in the desert - http://sottwell.com
                      Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
                      Join the Slack Community - http://modx.org