Admin User Management

Hi Everyone. Just hoping someone might be able to offer some advice. I am contracting freelance developers via the net to work on some improvements to my MODX website and would like to know how I can set up CONTROLLED access to a third party performing work on the site. In the event that I was unfortunate enough to hire someone malicious or incompetent, I want to be able to limit the damage they could do to my website and/or lock them out if it was necessary. I guess you might also need to know what type of work is required in order to know what requires access and what doesnt??!! HELP!! Any feedback would be HUGELY appreciated. Cheers, Paul

That's a big topic. Depends on what these freelancers might be doing ... i.e. some will need more permissions than others. The vast majority of freelancers I've worked with have been upstanding and professional, and it was much easier to hand them the keys to the house so to speak. That said, it's always a good idea to disable their logins when work is complete: that includes MODX and FTP logins.

You might find these useful:

http://bobsguides.com/revolution-permissions.html


http://bobsguides.com/revo-security-tutorials.html


---------------------------------------------------------------------------------------------------------------
PLEASE, PLEASE specify the version of MODX you are using . . . PLEASE!
MODx info for everyone: http://bobsguides.com/modx.html

Hi Bob & Everett. Re MODx version - alongside Version Codename it says rev 6066. I've attached a screenshot if that helps. I had a nightmare experience with the original developers of my website who took more than 3 years to publish the site. Spent thousands with them and now I;m still trying to fix stuff that was never done properly. I know absoutely NOTHING about MODx or any technical aspects of the site.

Would it be best for me to just create a new User specifying their 'Role' as "Editor' based on the pre-defined permissions under 'Editor' in the 'Roles' tab? Would this provide the developer with all the backend access they would need to properly quote on work? Would I be quite protected doing it this way or are there permissions (items) within the editor role that I should definteily block access to? The freelancer also asked about a copy of the sql file. Can he access this from the editor role and is that safe for me to give him?

[ed. note: qcaraust last edited this post 14 years, 8 months ago.]

First, remove the screenshot from the message above. TMI for hackers.

Take a close look at the MODX Manager screen. There should be a major version number around somewhere.

I wish there were an easy answer for you. It depends on what you need fixed. If it's just content or presentation, IOW editing html and css, they can have low rights. If it's to fix things wrong with MODX, they need a much higher level of access, even to give you a quote.

Once we know what version you have, we can give you better advice.

Can you give some examples of the things that need fixing?

Your surest form of security in this case is to have a backup. I know I cannot and will not work on a site without full Manager access as well as FTP access and access to the database.