Controlling access to files in MODX Revolution

I am wanting to limit access to what files & folders users can see in the MODX manager. So when user logs in and goes to the files tab they would only sees files with the assets/content/ directory.

I have tried this tutorial: http://www.gregorysmart.com/2010/11/19/guest-post-configuring-the-manager-for-the-non-administrator/ but have not been able to get this to work. I have 2.0.7 on IIS6 (if that makes a difference). Has anybody done something similar? Have any advice?

What about applying this to a group rather then just a user, is that possible?

Thanks for any help.

I just tried it and it doesn’t work for me either. I think this is a bug that’s been reported.

So is there currently no way to in Revolution to limit which files and directories a user has access to ?

Hi,

The only idea that came to my mind is checking the fielmanager_path & filemanager_url settings (system > system settings, then filter to only display File System options).
If you want to change those settings according to the user (you might want you account to be able to display all files, while your client only needs to access some folder), you can create those settings on a user basis (which will override the default system settings).

It’s also good to know that 2.1.0 will have (well, already available in the RCs builds) input properties, in case you have an image TV, you can set the path/url you want that TV to "load" file from, preventing your user to browser the whole file system.

I hope this will help

Thanks or the tips! That’s awesome that image tv’s are getting a default path option. That solves half the problem right there!

Still, shame I can’t also limit file browser access per user with the absurdly complex and confusing user management system

Sorry, i might have not been clear, that’s definitely a thing you can do.

Edit your user, go over « settings », create a new setting with the values :
key : filemanager_path
Area Lexicon entry (optionnal) : file
Value : relative/path/to/your/folder/

Create another one for filemanager_url. I guess you got the concept (each system setting can be overridden on a user basis, you just have to create a « user setting » with the key/system setting you want to change).

A quick tip : work with 2 browser tabs open, one for the system settings (right click > update setting), one for you user settings

Best luck

Thanks for clarifying. I’ll definitely give it a shot would be nice to at least lock it down to one directory where the user can manage their own uploads.

Though with overriding the filemanger path system settings this doesn’t let me say lock out assets/components,templates,scss,css,js and while allowing access to say assets/images, documents or any others the user might need, does it?

Not as far as i know. You’d have to make a proper file structure to achieve what you are expecting.
On my side, i usually do assets/sitename/ for all assets relative to website which my users don’t need to access to & assets/media/(images/videos/…) accessible to my users (and being there « home », filemanager_path).

As usual with MODX, it’s really up to you/your needs. That’s why it sometimes makes *you* feel lost, there is not only one way to do things

Romain: I finally got to try and implement this but setting per user setting for filemanager_path / url seem to have no effect in overriding the system settings.

http://www.rawcanvas.com/_/_skitch/per_user_permissions-20110421-003448.jpg

Also, even if this did work, wouldn’t this mess up the urls saved to TV’s by different users as one value would expect a different filemanager_url than the other?

Hmm, for the "not working" part, did you think about clearing the cache/flushing sessions ?

For the multi user part, i didn’t try TBH. But if i understood properly, i’d say if a user can edit a resource, he then *should* either :

• have access to what’s needed
• don’t be able to modify TVs values when it’s not needed

That’s easier to write than doing it i guess (never tried it)

To be sure i’m with you, let’s say you have users Steve & Bill.
Steve can access assets/cms/* & Bill assets/*

Your homepage contains an image TV, where the image is located in assets/images/
Bill can set this up, but Steve should be able to edit the homepage without editing/breaking the image TV.

Am i right ?