Wayfinder ignores Resource Groups?

Am I doing something wrong here? I have a WayFinder call that summarizes the contents of a folder -- however the folder has resources that belong to various non-public resource groups. WayFinder seems to be ignoring all of that and it simply spits out ALL resources, including those whose existence should not be known unless the current user has the correct permissions. This is a critical problem. Any help or thoughts are appreciated.

For grins and giggles, can you show us your call and also a few of the Resources/ACLs that should be blocked?

Sure. Here’s the call:



There are multiple files and folders under folder 1782, nearly all of them belong to a single resource group, e.g. one dedicated for a particular "client". The containing page, however, belongs to a generic "All Clients" resource group, but the idea was that if you logged in as "client A", you would only see the general public resources (belonging to the "All Clients" resource group) and any resources belonging to the dedicated "Client A" resource group. Instead, WayFinder is showing EVERYTHING for ALL clients.

I’ve cleared the cache, flushed permissions, and flushed all sessions, but still the problem persists.

Revo 2.1.1 on CentOS, PHP 5.3.6, MySQL 5.0.77

set &cacheResults=`0` and see what happens.

Also, are you running the latest WF version?

WayFinder 2.3.1, and using &cacheResults=`0` does not affect the results.

I assume you are not using the same browser that is holding your manager user session when viewing the pages?

I would like to see how you set up the ACLs.

Jason: correct, I’m testing this using different browsers.
wshawn: hmmm... I’m not sure the best way to demonstrate the ACLs... it’s a fairly complex site, but I don’t feel the ACLs are too complex. There are just a lot of them.

I’ve filed an official support request for this... even if it’s something simple, I’m just not seeing where or why it’s doing what it’s doing.

Quote from: Everett at Jun 12, 2011, 01:17 AM

Jason: correct, I’m testing this using different browsers.
wshawn: hmmm... I’m not sure the best way to demonstrate the ACLs... it’s a fairly complex site, but I don’t feel the ACLs are too complex. There are just a lot of them.

I’ve filed an official support request for this... even if it’s something simple, I’m just not seeing where or why it’s doing what it’s doing.

The key, as you probably know, is having a Resource Group Access ACL entry for each private Resource Group connecting it with a User Group that the viewer who shouldn’t see the page is not a member of (or doesn’t have the minimum required authority level set in the ACL entry) -- with a context of ’web’ .