Food for thought

Not through with the thread yet

As I told you I chose to use MODX for my next project so that I could make some concrete remarks, so I’m quickly testing some required functionalities to see if everything will be OK.

First I checked the FormIt plugin again, did a quick hook to add jQuery validation dynamically (by processing the validator parameter sent to FormIt). Runs great.

Next step. Security. This has driven me mad for a couple of hours now so I guess it’s my first concrete complain "WTF with the manual", before using the issue tracker I’ll submit this to you, maybe I missed something.

Been there : http://rtfm.modx.com/display/revolution20/Making+Member-Only+Pages

1 - Made 2 documents (home, test)
2 - Tutorial Step 1, Create a Resource Group - OK
3 - Tutorial Step 2, Link your member-only resource to the Resource Group : drag and dropped my "test" document OK. Did a quick check in its "Access permissions" tab : definitely OK.
4 - From the tutorial, again in step 2 : "It is important to realize that as soon as you have protected a resource by assigning it to one or more resource groups, those pages will no longer show up for users that are not linked to the resource group.". Riiiiiiiiiight, OK, let’s test this : flush permissions, clear cache, flush all sessions. Open another browser (Firefox before, now Chrome), clear all Chrome cache. Load the "test" document URL as an anonymous user : content is accessible. No 404 or whatever.

Did I misunderstand something? Maybe that’s because the anonymous user has access to the web context? Or not. Don’t know. Don’t get it.

---

Follow up : in the tutorial, the sentence next to the one I quoted is "The default behaviour in that case is displaying the 404-error page. If you would rather return the 403-error, you will need to give the anonymous user group "load" permission for the resource group.".

Maybe that’s stupid from me, but I did a quick search through all the MODX core files, and found no reference to 403. Found 404, 401, right. But no 403. So again maybe I just missed something but how can a 403 be generated there? Tutorial mistake? I’d like to check but I can’t even get the 404.

Is it possible that you skipped the step of connecting the Resource Group to a User Group (usually the Administrator group) with a Resource Group ACL entry with a context of ’web’?

The resources are not protected in the front end until you do that. Just putting them in a Resource Group isn’t enough.

Quote from: deadcow at Jun 25, 2011, 10:06 PM

Maybe that’s stupid from me, but I did a quick search through all the MODX core files, and found no reference to 403. Found 404, 401, right. But no 403. So again maybe I just missed something but how can a 403 be generated there? Tutorial mistake? I’d like to check but I can’t even get the 404.

That’s not stupid from you, i did a mistake adding this part, it’s indeed a 401 that will be replied telling you need to identify. Correcting right now, thanks for pointing that.

I’m pretty sure it actually is a 403 instead of 401..

*cough* Okay, learn something new every day

Just gave this a quick whirl on my site and it is indeed a 401.. fascinating.

That part seems to be missing from the tutorial though, so http://bugs.modx.com/issues/5115. See attachment for how to do it (set load only permission on the resource group, for the "anonymous" user group).


I’ve also updated those docs to show that piece of text at the right place - in step 4 where the link to a user group has been made.

OK much better now thanks everyone

Mark, step 4 : "Move on to the Resource Access tab". I guess that would be the "Resource Group Access" tab?
Then I’ll change "This tab defines the resources your user has access to if they are protected by resource groups." to "This tab defines the resources your *USER GROUP* has access to if they are protected by resource groups.".
Last, going back to "Move on to the Resource Access tab", that would be if the admin is updating the user group, which he’s not : after step 3 he’s still in "Security -> Access Controls". So this should be starting by "Right click on your user group and choose "Update User Group"".

OK perfect, I’ll go on with my stuff , thank again!

Hmm actually it seems one of the steps are missing, it used to tell you to add context access as well as your user groups *will* need access to the web context as far as I know

Shaun (splittingred) has removed it some time ago (don’t know why, sent him a tweet asking for clarification) and in the process a big part of the explanation of the different fields you are setting went missing. I could just restore that but I would like to know why he removed it to begin with.

Filed it to check in more detail @ http://bugs.modx.com/issues/5117

My experience as a n00b with little real dev background has been that the docs work fine as a reference and the framework itself is great (I absolutely love Revo), but there is indeed a bit of a gap when it comes to introductory tutorials.

Once I have my approach mapped out and I get into the middle of a project and I’m doing the nitty-gritty details, I can easily find out what I need in the API docs and I can do what I need to do quickly and with efficient code.

The difficulty I have is in figuring out where to start with a project. I want to implement functionality X - do I need to write a snippet, or a plugin, or a CMP, or an output filter, or...? If there is already a component that does something similar but not exactly like what I want to do, should I modify or extend it, or should I start from scratch? If I want to extend it, how do I do so without breaking forward-compatibility? The existing components I’ve looked at are great, they’re well-coded and built to be extendable, but the more complex ones have so many interconnected parts that it can be quite challenging to pick them apart and figure out how they work (for example, I’ve spent many hours in the last few days reading through the source code for Gallery, which is a wonderful package, but I’m only just beginning to feel that I understand something about how it works and I’m still not sure if I can adapt it for my current project or not).

As a result, I end up spending days figuring out how to do something and only a few minutes actually doing it.

I don’t mean this as a complaint, I’m still enjoying myself immensely and adding functionality I never thought would be possible, this is just an observation. I assumed this was simply due to my lack of experience, which is undoubtedly true, but it sounds like more experienced devs have had similar difficulties.

I think this is mostly a function of the young age of the framework. The docs were mostly written as a reference for experienced MODx devs looking to get into the new API (and also, in some cases, almost as a treatise in advanced theoretical computer science). That’s just fine for what it is, and as we grow as a community we will accumulate more introductory tutorial material.

I’d like to contribute to the docs, but I’m worried I’ll say something completely wrong due to inexperience. When I figure out how to do something I found tricky, I try to post on the forums about how I did it.

Maybe I’ll start a blog...

Quote from: esnyder at Jun 27, 2011, 12:07 PM

I’d like to contribute to the docs, but I’m worried I’ll say something completely wrong due to inexperience. When I figure out how to do something I found tricky, I try to post on the forums about how I did it.

Don’t worry about this as a barrier to contributions. If you say something wrong, either the community or the core team will correct it. I’d rather have a new docs contributor writing pages of documentation with a mistake here and there rather than no contributor at all.

You can also feel free to post questions, should you have them, as you contribute.

Don’t worry about this as a barrier to contributions.

OK, I won’t. If I can manage to figure out what the heck I’m trying to do with Gallery, I’ll write something about it.

Quote from: esnyder at Jun 27, 2011, 01:26 PM

OK, I won’t. If I can manage to figure out what the heck I’m trying to do with Gallery, I’ll write something about it.

Feel free to PM me if you need access when you start to contribute.