Can't get document / user groups to work as expected

do you have the option "use access permissions" checked in your site’s "tools | configuration" under the "user" tab, ?

[Edit - see ’edit’ area below (hopefully provided my own fix ]
I am having the same issue.
I want individuals to be able to login and edit a specific group of documents allocated to them.

User Group
’Content Editor A’

Document groups:
All ’public’ pages into a document group called ’Main Site Pages’
All ’Site A’ pages into a document group called ’Site A’

User / Document Group Links
’Content Editor A’ has access to ’Site A’


Manager Users
testedit has access permission set to ’Content Editor A’ and is of type ’Content Editor’

Roles
’Content Editor’ has only the default (greyed out) checkboxes plus ’Edit a Document’ and ’Save Documents’


Pages
’Modx CMS Install Success’ -> ’Main Site Pages’
’Home Page’ -> ’Main Site Pages’
’Content Editing Test’ -> ’Site A’

Checked to make sure access permission are enabled in the Tools->Configuration, Users tab.

I went and cleared the cache as suggested.

Logged in as testedit

I could still see all the pages in the treeview
and I could edit all the pages.

If I went back to Roles and unchecked ’Edit a document’
then I could still see the pages but when you attempt to edit then
the security stop you.


Feel free to tell me I am doing this completely the wrong way

Cheers
Dave

[Edit - Fixed it for my solution...I hope]
Ok, I went back in and created a Site B, (new settings in blue italics)
now settings are as below:

User Group
’Content Editor A’
’Content Editor B’

Document groups:
All ’public’ pages into a document group called ’Main Site Pages’
All ’Site A’ pages into a document group called ’Site A’
All ’Site B’ pages into a document group called ’Site B’

User / Document Group Links
’Content Editor A’ has access to ’Site A’
’Content Editor B’ has access to ’Site B’

Manager Users
testedit has access permission set to ’Content Editor A’ and is of type ’Content Editor’
testedit2 has access permission set to ’Content Editor B’ and is of type ’Content Editor’

Roles
’Content Editor’ has only the default (greyed out) checkboxes plus ’Edit a Document’ and ’Save Documents’


Pages
’Modx CMS Install Success’ -> ’Main Site Pages’
’Home Page’ -> ’Main Site Pages’
’Content Editing Test’ -> ’Site A’
’Content Editing Test 2’ -> ’Site B’

Ok. So I then logged in as testedit2 to look at ’Site B’ stuff. Well ’lo and behold, the ’Site A’ stuff didn’t show up.
So the security works - then there must be something that allows pages that are allocated
to a ’Document group’ but with no allocated ’Document/User Links’ to then be shown as (standard) ’Public’ pages.

I created another User Group ’Main Site Editors’ and allocated the ’Main Site Pages’ to it in the ’Document/User Links’

Logged back in as testedit. Only the ’Site A’ page came up
Logged in as testedit2. Only the ’Site B’ page came up.
Wonderful.

Now - a simple question - is this a bug, a misunderstanding, or just something in need of a little clarification?

Cheers
Dave

To me, it’s a poor implementation. Unless everything is strictly public, i.e. there are no docgroups, everything should be deny all unless specifically prohibited. This is allow all unless specifically denied. Frustrating and confusing indeed.

Quote from: seventhapex at Feb 12, 2007, 10:10 PM

do you have the option "use access permissions" checked in your site’s "tools | configuration" under the "user" tab, ?

I certainly do!

Quote from: rthrash

To me, it’s a poor implementation.

So is this behaviour likely to be looked at for the next version?
Also, do you have any idea why my new role can’t access QuickEdit?

Thanks,

/\dam

I don’t know why I didn’t think to bring that up.

create a doc group called "noAccess" and assign it to no-one (admin will have rights). then assign all docs to this group, and it should limit the users to docs within whatever group they are in.

I suggest the doc manager for this "resources|modules|docManager".

Thanks seventhapex,
I followed your suggestions and have partial success. My friend user can now see the Quick Edit pages on the pages he has permission for, but it does not appear for other pages. So, that would seem to be perfect.
However, as soon as he goes to the Manager, yes, you guessed it, full and total access to all documents.

Are you saying that on your 0.9.5 install you can indeed restrict a user to only editing their own documents?

Thanks for your feedback,

/\dam

Just for the record, I am experiencing the same problems.

My desire: to allow certain people to edit only "their" section of the site.

To do this I:

(1) turned on User Permissions in the configuration

(2) Created a user_group called "Business"

(3) Created a document_group called "Business"

(4) Every document relating to business I associated with the "Business" document_group

(5) I associated a user with the user_group "Business"

(6) I created a document_group called "Unassigned" and moved all documents except Business over to "Unassigned" so that there are no "Public" documents.

(7) The role my "Business" user is assigned to only allows for editing, saving and publishing.

When my "Business" user signs in to the Manager, he still has access to EVERYTHING.

@lee:
this might be too simple, but make sure your user isn’t assigned to the administrator "role". if he is that role will overwrite any permissions you set up with doc_groups...

No, like I said in #7 above, the role only allows for editing, saving, publishing. But thanks for the input ... several times I have worked for hours to fix something that was insanely simple!

I’ll keep tweeking it ... maybe its me, but when I saw this forum with others having similar problems, I thought maybe there was more to it.

Again, thanks for responding.

woops, I’m not paying much attention huh? Sorry.

Anyway, a quick way to setup and test this kinda thing is to open up your admin user in "www.domain.com/manager" and then login as the testing user at "domain.com/manager", this will allow you to run two sessions while trying to sort these issues out. This way you’ll only need to log out and back in as the "Test User", keeping your admin user open to mod your "test user’s" privileges.