0.9.5 Permissions Broken?

First seem my disclaimer below.

On to business. Is it just me or does the 0.9.5 release have broken manager permissions? Just thought I’d check with the community before I posted a bug - because it’s certainly possible that I just didn’t do something right. Here’s what I did:

* Created a new CM (content manager) role with content editing privileges only
* Created a new document group "Some group"
* Created a new user group "CMs"
* Linked the CMs user group to the Somg group document group (all in "manager" permissions, not web user)
* Created a new user "test" with the CM role, and a member of CMs user group
* Assigned a page (24: Extendable by Design - from test install) to the Some group document group

Now my test user can still edit ANY document. It appears that the user has the correct abilities (menu options etc.) but without regard to the page’s group(s).

Can anyone confirm this or show me the thing I overlooked?

Umm, just a thought, check if you made all "All Document Groups (Public)" docs into some restrictive group?

I have tried this, and my test user is able to edit and save a document assigned to a different document group. Jared could be right here, it looks to be a bug.

Here is what I do, (Manager Permissions)

1. Create 2 User groups: SiteAdmins, SiteEditors
2. Create 2 Document Groups: SiteAdminsDocs, SiteEditorsDocs
3. Attach ALL of available documents in site to "SiteAdminsDocs".
4. Link: SiteAdmins -> SiteAdminDocs, SiteEditors -> SiteEditorsDoc.
5. Create a ROLE: SiteEditors -> (tick all General, Content Management options), save.
6. Put a new user with ROLE: SiteEditors
7. Edit some documents and assign them to SiteEditorsDocs document group.
8. Logout, and login with the new user, you should see only those documents which you just assigned to "SiteEditorsDoc"

I hope I covered it ...

Unfortunately, that’s not a very practical solution in my case. My site has 2300+ pages.

As of right now (on a prior release of MODx), the permissions work fine. The content editor can’t edit unless explicitly given ability to do so. If my understanding is correct, what is being suggested is that the 0.9.5 model is everyone can edit unless explicitly NOT given the ability. A subtle difference but a significant one. I will try migrating my site to a test server to see how the rubber hits the road. Stay tuned...

But generally speaking, I’d prefer can’t unless allowed over can unless denied for manager perms.

If you have to choose one over the other, I vote for disallow unless specifically granted permission. Otherwise, I prefer it being an administratively configurable option.