Login, Security and Contexts

Setup:
MODX Revolution 2.1.3-pl (advanced)
Login 1.7.0-pl

Background:
The site has 3 Contexts. I created a Resource in default 'web' context, called "Login" with the snippet call:



DocID#92 is a child resource of "Login" page. I then followed best practices here: http://rtfm.modx.com/display/revolution20/Making+Member-Only+Pages

Everything worked beautifully! Then client wanted the Login Area in one of the secondary Contexts instead. "No problem", I thought. Dragged the "Login" Resource to the other Context in the Resource Tree.

BUG: Child resources disappeared. Used Batcher to find them, changed Parent to DocID#1 in 'web' Context and dragged them over individually. Weird little inconsistencies kept happening but I finally got it all working.

THEN: Security is broken on the Private DocID#92 now. ANYONE can see it.

Things I tried:
Deleting the Resource Group, User Group, and Resource itself and creating these from scratch, all the while Flushing permissions, Flushing MODX Cache, and using a different browser to test.

I'm out of ideas. Anyone? (Thanks in advance

If you want to login to a different context you usually need to specify that in your login snippet call: &contexts=`web,ctx2,ctx3`, or just &contexts=`ctx2` (check docs if I got the syntax right).

What you may experience as #92 begin visible to all could be the user getting authorized for the web contexts instead of the context you would expect.

I've witnessed that bug with moving a parent w/ children as well in 2.2, though I was too busy with getting other stuff to notice at first.

WOW. Thanks for your quick response, Mark

I added that property to the snippet call, but the problem I'm seeing is, I can type in the URL of the private page and view it, no matter which browser I'm using, regardless of login state, even after Flushing Sessions, Permission, MODX Cache, and browser cache. So a completely fresh, unknown user is getting access permission to this page.

???

**Update: Un-installing and re-installing Login snippet did not help. [ed. note: sepiariver last edited this post 14 years, 11 months ago.]

Problem solved! Mark gave me and idea: I looked in the DB table

'modx_access_resource_groups'

and found the context key 'web', which I changed to the context with the Private page. Voila - all works again.

Not sure if this was improperly set in User Groups - quite possibly - but I found it in a backwards way Thanks Mark for your inspiration!!

Hehe, glad my inspiration helped you out

(And I've figured out many problems from browsing the database myself!)