Just as I was configuring the manager for a client I noticed a "gap" of sorts in the permission system, which I did not notice earlier : you can’t deny access to the "Tools" item in the manager menu. I have just set up a basic editor’s role and despite limited permissions, the editor still has access to "Import" and "Export" in the Tools menu (which I’d rather they not have).
Is there any way to hack the manager into submission (so to speak), to remove those two items ?
Thanks !
.: COO - Commerce Guys - Community Driven Innovation :.
MODx est l'outil id
-
MODX Staff
- 12,272 Posts
This may be a candidate for a permissions review.
Ryan Thrash, MODX Co-Founder
Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
Thanks for the quick and dirty fix TobyL
.: COO - Commerce Guys - Community Driven Innovation :.
MODx est l'outil id
Now that I have dug into this a bit more, I think rather than commenting I’ll tweak permissions this way :
Change line 316 to 320 :
<?php if($modx->hasPermission('new_document')) { ?>
<!--import-html--><li><a onclick="this.blur();" href="index.php?a=95" target="main"><?php echo $_lang["import_site"]; ?></a></li>
<?php } ?>
<?php if($modx->hasPermission('edit_document')) { ?>
<!--export-static-site--><li><a onclick="this.blur();" href="index.php?a=83" target="main"><?php echo $_lang["export_site"]; ?></a></li>
Into
<?php if($modx->hasPermission('settings')) { ?>
<!--import-html--><li><a onclick="this.blur();" href="index.php?a=95" target="main"><?php echo $_lang["import_site"]; ?></a></li>
<?php } ?>
<?php if($modx->hasPermission('settings')) { ?>
<!--export-static-site--><li><a onclick="this.blur();" href="index.php?a=83" target="main"><?php echo $_lang["export_site"]; ?></a></li>
Importing and exporting html is not trivial, and should remain a privilege of the website admin, IMHO.
Now if you think of a more appropriate permission, please tell me !
Just logged this into FlySpray :
http://modxcms.com/bugs/task/599
.: COO - Commerce Guys - Community Driven Innovation :.
MODx est l'outil id
Your permissions tweak only affects the display of the link, and it is still possible for users to visit index.php?a=95 or index.php?a=83 to import or export the site. Thus this isn’t actually any more secure than commenting, it’s just more convenient for admin users who will still see the links.
If the decision is made to restrict these features to People Who Can Mess With Settings, then the routines themselves will need amending too.
For the record, I’m in favour of two extra permissions as it’s the cleanest and most straight-forward.
No no it’s no more secure than commenting, for sure, but at least I still have those items handy when I am logged in as admin.
I needed a quick and dirty fix there, and the users in my case won’t be able to mess with settings...
.: COO - Commerce Guys - Community Driven Innovation :.
MODx est l'outil id
Quick note : If you need to do the same thing, don’t forget to also edit welcome.static.php
Line 35, remove the ’exec-module’ permission...
.: COO - Commerce Guys - Community Driven Innovation :.
MODx est l'outil id
