Ihave set up some pages that only should be accessible by specific user groups but all of these webuser groups can access each others documents.
I have tested all sort of solution. Logged out from backend. Tried both major browsers and they are acting the same. My pages are set to be non cacheable.
My structur is this:
a login page for five diffent webuser. Depending on which user is logging in they will be directed to there own page. The pages contains the filedownload snippet and a fileupload snippet which is only accesible to one group. The fileupload is working fine but still the other user can access eachothers documents
Solutions ?
-
MODX Staff
- 12,272 Posts
Which version are you running?
Ryan Thrash, MODX Co-Founder
Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
When you talk of documents that can be accessed by URL, do you mean MODx webpages or document files that have been uploaded using the fileupload snippet?
Im running modx 0.92.1.
I mean accesing the webpages from your browser logged in as a webuser. for instance the url a user is accesing can be index.php?id=41 then if i change the id to 42 I can then access a document which im am not allow to.
That shouldnt be possible.
I have found what seems to be the bug Its the access permision area where document groups this document belongs to are failing.
I have two document groups selected here when i deselect so only one is selected. It cant be accessed by other users.
The idea that im working on is to have an "administrator" webuser who can upload files into all the pages via the fileupload which must not be accesible to the othe users.
-
☆ A M B ☆
- 24,524 Posts
So just make your admin user a member of all the groups, and your documents belong to the appropriate document group. You don’t need a specific "admin" group.
