Can't get document / user groups to work as expected

I’ve come to the conclusion that the permissions system is fundamentally broken in 0.9.5. I’ve tried literally dozens of settings and can’t see what else there is I can do. As it isn’t critical to me I am going to continue to enjoy the rest of MODx and hope that the permission are looked at in the next version!

/\dam

I’m running 9.5 and I’m not having problems like this. In my opinion user permissions in MODx work backward what they should. They always have. I’m gonna submit a wishlist item for this. and if you think you’ve truly encountered a problem/bug then you should submit a bug tracker thicket.

lee - try assigning a user to your ’Unassigned’ group. I *think* I was in a similar situation to you and ModX ignored the settings of the ’unassigned’ group because there was no users in it. (if I can remember rightly - been a bit busy at work so haven’t been playing!)
Simple to try it anyway...?

I am experiencing this very issue in v0.9.6:

We have created a "Content Manager Role" Role, and a "Content Manager" User Group. We have also created a couple of Document Groups.

Then, under "Manager Access Permissions" we have set up the User/Document Group Link to limit only to the desired areas (doc groups) for the desired "Content Manager" User group.

In "Manager Users", our defined "content editor" test user is properly added to the "Content Manager Role" role we had set up earlier, and also the checkbox for adding this user to the "Content Manager" document group is checked.

At this point we would expect everything to work....Only it doesn’t. The role seems to limit functionality correctly, but the document group permissions seem to be ignored. We have tested VERY heavily with the Web User document groups and are receiving great results, just as expected. Only Manager-side document groups seems to be broken.

We have defined Document Groups for ALL of the secure content (both Web and Manger-side). While Ryan pointed out the current system is "allow all unless manually declined", we have ensured that the section we DON’T want this test user to access is "manually declined" by implicitly adding this section of documents to a "Secure" DocGroup that is not part of the "Content Manager" user/doc group link ....

This is a pretty big hole, IMO...

Anyone else found the problem/solution?

UPDATE:

http://modxcms.com/bugs/task/835

This link above is the best I could find. However, it appears to be lumped into a "Feature Request", and rather should maybe split into a "Bug" and "Feature Request"??


I guess once the light comes on behind "Everything is allowed unless implicitly declined" it all becomes more clear... I was setting up based on what I wanted them to have access to, not the other way around.