Can't get document / user groups to work as expected

I’ve read the docs and installed a fresh version of 0.9.5 to play about with manager user permissions.
What I’m trying to achieve is for a friend to be able to edit one set of documents on my website, all within a single container.

So, I’ve set up a test role called "friend-role" and assigned it "edit/save" CMS permissions.
Then I set up a test user (friend-user) and assigned him to that role.
I then set up a new user + document group and bound them together, and ensured that my friend-user was assigned correctly. ie: he is part of a friend-user-group, which is bound only to friend-docs.
I then changed a new document container’s group to be friend-docs.

So, what I expected is that my friend could login to the manager system, but only edit the friend container page.
However, they actually had edit access to every document.
Thinking that this could be because all my docs were assigned to the default "public" group I then created a new doc group (personal) and changed some documents to that one - but my friend user could still edit them.
Also, my friend user did not have access to the quickedit link when browsing the site, despite being a manager user.

Currently, the only way I’ve managed to resolve this is to set my friend user’s "manager interface access" to "no". I then changed his role to that of Administrator, and changed his default start document to point to the new test container.
This is pretty much good enough for my purposes, as he can now use the "quickedit" link on that set of documents, but can’t for ones that I flag as "personal".

However, the former behaviour I saw is not what the documentation says should happen - any idea what I did wrong?

Also, is there any way to bulk change all my pages to be "personal" and also have new documents that I create default to that group? Currently, if I forget to change a page’s document group, my friend will be able to edit it.

Thanks!

/\dam

UPDATE:
Actually my above setup doesn’t work for me, because even though "quickedit" is showing, when my friend actually tries to edit the document content, they are not allowed to (presumably because I denied them access to the manager interface)

So it seems I need to fix my previous permissions problems after all...

/\dam

I’ve had another play, but still can’t grant my friend access to some documents and restrict access to all the rest.
At this point I’m out of ideas. Is it a known bug in 0.9.5 (surely not, or it would be mentioned on the forums!) or am I doing something stupid?

Thanks for any help,

/\dam

All documents need to be assigned to a document group, then only users belonging to a corresponding user group can access them. If any documents are still assigned to the "public-all users" group, then any manager user can access them.

Thanks for the reply.
I understand that public documents may be edited by anoyone - but my documents are not public.
The security seems to work for QuickEdit - but if I manually navigate my friend user to the manager console (and I can see in the top right that he is logged in with his username), then I can edit *any* document.

So, the security is working on my setup for QuickEdit, but not once the user is within the Manager console.

My friend’s role is Administrator, so is this expected behaviour? If I change his role, he loses access to the QuickEdit link, even if that role has full CMS permissions. Also, once in the Manager console, he *still* can edit every document.

Are there any other tests I can do?

Is there any possibility that this is a session problem caused by me testing two users from the same PC? I’ve logged in as myself using Firefox and my friend using IE to try and minimise this possibility.

Thanks for any help,

/\dam

Apologies for bumping this, but I’m honestly stuck here without some kind of assistance. I currently don’t even know if the behaviour I am seeing is what should be expected.

Thanks,

/\dam

I’m getting exactly the same problem.

A test user is defined a "content editor" role and is then added to a new user group "test group".

A document group is defined and pages added to that (ie not public). The document group and user group are linked.

When the test user is logged in the role permissions are honoured (ie they can only edit page, not templates etc) but the document group permissions are not, so they can edit any page.

Any thoughts anyone?

I’m on 0.9.5

Thanks for replying, I was beginning to think I was the only one struggling with this!
I’d be tempted to say it was a bug in 0.9.5 - but if it were I would have expected more discussion about it.

/\dam

I don’t believe this is a bug, try to clear the sites cache after you mod your permissions and your users should work like expected.

Quote from: seventhapex at Feb 12, 2007, 03:03 PM

I don’t believe this is a bug, try to clear the sites cache after you mod your permissions and your users should work like expected.

I can confirm that I have now cleared the cache with no effect.
Additional information: I have now assigned every single permission possible to my "Friend" role. ie: in "edit role" I have ticked every box. As far as I can tell this makes the "Friend" role no different to "Administrator", yet my friend user still cannot access "Quick Edit". However, when my friend user logs into the manager, then he can edit any document he wants.

In Modules->Manage Modules->Quick Edit-Edit permissions are given to the Quick Edit module for "All User Groups (Public)"

/\dam