Manager permissions for children docs?

Hi All,

I’ve had a bit of a hunt around and can’t find what I’m looking for...

Basically I have multiple manager user groups that are linked with document groups. I have a document structure like this:

• Service Overview[list]
  [li]State[list]
  [li]Region 1
• Region 2

[/li]
[/list]
[/li]
[/list]

So I want the users to be able to create documents only in their regions (region 1 & region 2). At the moment I’ve locked the regions to the user, however the users are still able to create documents in both the State and Service Overview pages as they are not locked to a group yet. I tried locking these pages to admin, but that stopped the user being able to log see their regions too. I’m assuming this is because the permissions from the parent flow down into the children, even though I’ve assigned different permissions to the children

Does anyone know a way to fix this?

Cheers
Free

There is an option in the Configuration to allow the users to "see" all of the document tree, even if they can only actually work with certain documents. It’s in the Interface and Features tab; "Show Protected Pages".

It’s a side effect of how the document tree nodes are generated and displayed with the Javascript. I personally don’t have a strong enough motivation to force me to dive into that morass (I hate Javascript) to work out a way of generating the Tree in a more granular manner so that it would display all documents a user has permission to work with; that would require a complete rewrite of the whole Tree system!

Bugger!

So are you saying the only way a user can see folders they have access too that are inside a folder they don’t is to show the protected docs so they can see everything, but only edit what they have permission for?

Cheers
Free

You got it. Ugly, but that’s the best there is for now.

All good, just glad to know that I can stop banging my head against my desk and I can move on to the next problem

Hi F O’Toole,

So I want the users to be able to create documents only in their regions (region 1 & region 2). At the moment I’ve locked the regions to the user, however the users are still able to create documents in both the State and Service Overview pages

have a look at ManagerManager’s accessdenied-widget:

Denies access to specific documents (by ID) without inheritance.

For example, if the parent document has some Ditto call (which you do not want a user to edit) but want to allow them to create child documents.

Use this plugin with caution, as while it offers a basic level of protection, it does not prevent access to documents in the same was as ModX’s permissions system. It would be possible for a user with technical knowledge to override it. Think of it as a "No entry" sign for an unlocked door, rather than a lock.

Quote from: sharkbait at Nov 01, 2009, 11:27 PM

Hi F O’Toole,

So I want the users to be able to create documents only in their regions (region 1 & region 2). At the moment I’ve locked the regions to the user, however the users are still able to create documents in both the State and Service Overview pages

have a look at ManagerManager’s accessdenied-widget:

Denies access to specific documents (by ID) without inheritance.

For example, if the parent document has some Ditto call (which you do not want a user to edit) but want to allow them to create child documents.

Use this plugin with caution, as while it offers a basic level of protection, it does not prevent access to documents in the same was as ModX’s permissions system. It would be possible for a user with technical knowledge to override it. Think of it as a "No entry" sign for an unlocked door, rather than a lock.

Cool, I’ll give that a look, sounds what I’m after though, basically some of the users aren’t very good with tech or instructions and if they can accidentally do something wrong, they will. So a No Entry sign is exactly what they need.

Thanks
Free

So I checked out the access denied widget and alas, it doesn’t quite do what’s needed

It works perfectly to stop the user editing a document, but doesn’t stop them creating a document inside it. I’m guessing this is because the access doesn’t apply to children of the document so is probably non-fixable

Thanks for the idea though

Cheers
Free