Permissions making me crazy

I’m trying to something that seems like it should be really simple (and probably is for everyone but me ).

I want to control which managers can edit a particular group of pages.

For example: The news pages are all in the news folder and I want the "News Manager" to be able to edit and delete them when logged on as a manager but I don’t want the "Photo Manager" to be able to do either.

All the news pages need to be seen by the public. If I add them to a document group, they are no longer visible to the public (via Ditto). If I don’t add them to a document group, any manager can edit them.

I guess front-end editing for logged-in web users in the appropriate group would solve this, but I can’t find anything in the repository (or anywhere else) that does it without hacking the core code.

Can somebody please tell me what dumb mistake I’m making? It can’t be this difficult to control who can edit public pages.

Bob

Hey, don’t go crazy BobRay


Quote from: BobRay at Apr 27, 2007, 06:43 PM

I’m trying to something that seems like it should be really simple (and probably is for everyone but me ).

It’s never that simple for anyone at first, not until you grasp user groups, document groups and the link between the two.

Quote from: BobRay

I want to control which managers can edit a particular group of pages.

First, you have to enable permissions : Tools > Configuration > User : Use access permissions, check Yes.

Then you create a document group for each particular group of pages (Security > Manager Permissions). Then create as many user groups as you need. And then go to the User/Document group links tab and associate user groups the permission to access document groups as you see fit.



Quote from: BobRay

For example: The news pages are all in the news folder and I want the "News Manager" to be able to edit and delete them when logged on as a manager but I don’t want the "Photo Manager" to be able to do either. All the news pages need to be seen by the public. If I add them to a document group, they are no longer visible to the public (via Ditto). If I don’t add them to a document group, any manager can edit them. I guess front-end editing for logged-in web users in the appropriate group would solve this, but I can’t find anything in the repository (or anywhere else) that does it without hacking the core code. Can somebody please tell me what dumb mistake I’m making? It can’t be this difficult to control who can edit public pages.

Remember that there are two types of users and permissions in MODx : web (that’s for private pages on the front-end) and manager.
What you did was assign web user permission instead of manager permission.

It’s not difficult to do what you want to do. No hacking involved
In your case, create 2 user groups (in Manager Permissions !) : News manager and Photo manager.
Create two document groups : let’s say, News and Photo. Assign the Photo manager user group to the Photo document group, and same for News.

Then, when you create or edit a document, choose the appropriate permissions (bottom of the page).
For existing documents, use the DocManager module to batch permissions change (see Document permissions tab in DocManager)

David,

Thanks for the very well-written guide and the quick reply.

I did have permissions enabled and I have the document groups set up. I think I understand the difference between web permissions and manager permissions.

Here’s where I’m still hung up. In my understanding, once I click on a document group other than "public" at the bottom of a document creation page, "public" is unchecked and the document can’t be viewed by the public.

As a result, any page that I want to assign to a specific document group disappears from the web site for regular (non-logged-on) users. I can’t figure out how to control who can edit a document in the manager without having the page disappear from the public web site.

I hope I’m making this clear.

I’m sure I’m still doing something wrong but I’ll be darned if I can figure out what it is. :’(

Bob

Quote from: BobRay at Apr 28, 2007, 10:30 AM

David,
Thanks for the very well-written guide and the quick reply.

:)

Quote from: BobRay

I did have permissions enabled and I have the document groups set up. I think I understand the difference between web permissions and manager permissions. Here’s where I’m still hung up. In my understanding, once I click on a document group other than "public" at the bottom of a document creation page, "public" is unchecked and the document can’t be viewed by the public. As a result, any page that I want to assign to a specific document group disappears from the web site for regular (non-logged-on) users. I can’t figure out how to control who can edit a document in the manager without having the page disappear from the public web site. I hope I’m making this clear. I’m sure I’m still doing something wrong but I’ll be darned if I can figure out what it is. :’(

We’ll debunk the situation, no sweat.

"In my understanding, once I click on a document group other than "public" at the bottom of a document creation page, "public" is unchecked and the document can’t be viewed by the public"

Well, yes and no. Let’s be explicit here : if you assign a document group which is not public to a document, and tie it to a manager user group it won’t become private on the frontend. It will just not show up for manager users logged in the manager, that’s the whole purpose.

What you describe will only happen if you have assigned a document group to a web user group. One thing which could have happened to you is, if you assigned both a web user group AND a manager user group the same document group... is it clear now ?

Quote from: davidm at Apr 28, 2007, 11:15 AM

Quote from: BobRay at Apr 28, 2007, 10:30 AM

David,
Thanks for the very well-written guide and the quick reply.

:)

Quote from: BobRay

We’ll debunk the situation, no sweat.

Let’s be explicit here : if you assign a document group which is not public to a document, and tie it to a manager user group it won’t become private on the frontend. It will just not show up for manager users logged in the manager, that’s the whole purpose.

What you describe will only happen if you have assigned a document group to a web user group. One thing which could have happened to you is, if you assigned both a web user group AND a manager user group the same document group... is it clear now ?

Aha!!! This is clearly the secret to life as we know it.

Thanks so much. I was beginning to suspect something of the kind but I’m not sure I would have completely understood what was going on (at least not for a long, long time) without your timely and crystal-clear help.

Thanks again,

Bob

MODx is a bit singular with a dual permission system (web and manager users) which is not that intuitive at first, but document groups and user groups allow for nice flexibility in the end to handle permissions...

Glad I could help