Hello, colleagues. I want to make certain resource to be accessible only for certain user using Modx Revolution. I’ve read documentation about modx permissions, it suggests to use modUserSetting to define root_tree_id setting. It works normally, in resources tree user can see only resources, which assign to him. But this setting is not secure, because user can edit other documents if enter url of other document in browser address line. Using resourceGroups and roles seems to be not right solution because number of user can be more than thousand. Is there any other way to resolve this?
I’ve found class modAccessResource and table in database called modx_access_resources. I suppose it is what I need, but there is no any documentation abou this and I haven’t found actions in manager to control this. Also there is no any code in modAccessResource class. Maybe it has not been completed yet?
Friends, any suggestions? Let’s think together...
Do you want the resource available to that user in the front end or the Manager (or both)?
Assuming that it’s the Manager, you need to put all the documents on the site *except for the one you want the user to see* into a Resource Group and connect that Resource Group with the Administrator User Group with a Resource Group Access ACL entry (with a context of mgr and a policy of resource). That will protect all resources but that one and hide them from the user.
Basically you want to follow these two tutorials (in order):
http://bobsguides.com/creating-manager-users.html
http://bobsguides.com/hiding-resources-in-the-manager.html
Bob, thanks for your reply. I’ve already read it. If I’ve understand it right, if I have, for example, 300 different users and I want they can access only one resource, I need to create 300 different user groups and 300 different resource groups? Or I’m wrong?
AFAIK, that’s correct. In the front end, you can protect the pages with a custom snippet, but in the Manager, I don’t know an easy way.
You can create a plugin that creates the user group and resource group when the user registers or when a new user is created. You could also write a snippet that would create a user group and resource group all existing users. If the user group and resource group were named after the username (and you have no duplicate usernames), that part would be fairly easy. You could also create the ACL entry there, but I can’t give you the code for that off the top of my head. Combining those actions with the plugin might do the job.
Another way to go: I think you might be able to create a plugin attached to OnDocFormPrerender that would reject users when they try to access any page but their own in the Manager (redirecting them back to the Manager home page -- or somewhere else). If each user had a tree_root_id User Setting, the plugin could check that. It would be secure and would hide the other resources in the tree too.
Yet another way to go would be to have the users edit their pages in the front end with NewsPublisher and use a snippet that checks the tree_root_id (or modify the NewsPublisher code to do that) for each user to see if they can see the page.
Maybe someone else has a better idea.
Thanks, Bob. I’ve already wrote a plugin with tree_root_id setting as you suggest. Just wanted to know, maybe there was any other way. Thanks a lot.
And what do you think about class modAccessResource and db table modx_access_resources? what could it be?
It’s either that or modAccessResourceGroups
You might find some help here:
http://api.modxcms.com/
I’m afraid I don’t understand those classes and tables well enough to help and I couldn’t find them in the schema.
