[SOLVED] Member-only pages: can't setup

Quote from: BobRay at Mar 05, 2012, 09:02 PM

When you protect resources by putting them in a resource group that's connected to a user group, you protect them from the admin too. If you really need to see protected resources in the front end or back end, you need to add yourself to all user groups or create an Resource Group Access ACL entry for Administrators for each resource group.

Actually I had Resource Group ACL for both Administrator and Author groups. Then I thought maybe it will interfere somehow, so tried to delete the admin's Resource Group ACL to have only one ACL -- for Author group. But unfortunately it didn't help too: the resource stops showing up as soon as the user (this time an Author) logins to manager.

Let's back up.

Are you trying to restrict access to the pages in the front-end, or the Manager, or both?

What rights do you want for the resources in the Author's resource group in the Manager (and for which users)?

What rights do you want for the resources in the Author's resource group in the front end (and for which users)?.


What rights do you want for the resources *outside* the Author's resource group in the Manager (and for which users)?

What rights do you want for the resources *outside* the Author's resource group in the front end (and for which users)?.


---------------------------------------------------------------------------------------------------------------
PLEASE, PLEASE specify the version of MODX you are using . . . PLEASE!
MODX info for everyone: http://bobsguides.com/modx.html

Thank you, BobRay and others, for you patience. I highly appreciate the fact that you're spending your time to help me.

The situation is basically the following. There are two users: one in the admin group and one in the author group. I have two resources which I want only these two usergroups' users with minimum authority 100 to access (view) at frontend.

No manager restrictions are needed at this point.

(The resources are a simple form and an AJAX point for fast-creating resources with content-targeted assistance (parallel tranlations of Bible.)

OK, for that, you want *no* Resource Group Access ACL entries with a context of 'mgr' and the setup is fairly simple.

I'm assuming the user groups are called Author and Administrator and the resource groups are called AuthorResources and AdminResources (though you can name them anything you want as long as they match the ACL entries).

You want two *Resource Group* Access ACL entries.

1. Connect the Author User Group to the AuthorResources Resource Group using a Resource Group Access ACL entry with a context of 'web' and a Policy of 'Load, List, and View' with a minimum role that the Author's will qualify for (IOW, with an equal or lower number than the authority level of the role they have in the Authors user group).

2. Do exactly the same thing for the Administrator group and the AdminResource resource group.

Flush permissions and settings.

Don't log in to the Manager.

Both resources should be hidden from all other users in the front end and logged-in Admin or Author users (logged in in the front end) should each see the one extra resource they are supposed to see.


---------------------------------------------------------------------------------------------------------------
PLEASE, PLEASE specify the version of MODX you are using . . . PLEASE!
MODX info for everyone: http://bobsguides.com/modx.html [ed. note: BobRay last edited this post 14 years, 6 months ago.]

Thank you for your reply.

For now I only created the Resource Group ACL for Authors group (just to simplify things). I cleared cache, flushed sessions, cleared cookies in the browser.

Now I'm able to login to frontend (as an Author) and access the protected resource (Minimum role - 100, context - web). But as soon as I login to manager (as the same Author user), I'm not able to access the protected resource anymore from the frontend. Even when I logout from manager, the protected resource remains inaccessible although the frontend session is still active.

Try this. Clear all the sessions and log into the front end as the admin. You should see the resource. Then log into the Manager *in another browser* (not another session in the same browser. You should still see the resource in the first browser.

When you're logged into the Manager and look at the front end, you're still logged into the Manager, so the permissions are unusual -- MODX sees you as being in the 'mgr' context, so the ACL entry doesn't apply. It's something that would never happen to a regular user.

I always have another browser handy when I'm testing permissions so I can see the site as a real user would and I tend to ignore the weird access stuff I see when I'm previewing from the Manager.




---------------------------------------------------------------------------------------------------------------
PLEASE, PLEASE specify the version of MODX you are using . . . PLEASE!
MODX info for everyone: http://bobsguides.com/modx.html

Ok, thanks for the tip and for helping me with this. I will do as you suggest.

I know I may be a little annoying, but...

When I log in to manager I see this in web inspector's HTTP response log:


A kind of dev question. Could someone give me a hint at which file to look to [maybe] change the cookie path when logging in to manager from '/' to '/manager/' (or whatever the constant 'MODX_MANAGER_URL' is)...

[edit]
Found how to do this, but it's useless because manager makes ajax requests to /connectors as well... (If one would still need to do this, it's simple: you have to add a 'session_cookie_path' setting to 'mgr' context under 'System -> Contexts' menu button.)
[/edit] [ed. note: yurkobb last edited this post 14 years, 6 months ago.]

It's out of my area of expertise, but I wouldn't try to change it unless you're having trouble in the Manager.


---------------------------------------------------------------------------------------------------------------
PLEASE, PLEASE specify the version of MODX you are using . . . PLEASE!
MODX info for everyone: http://bobsguides.com/modx.html

Just found a neat fix for the issue. After adding a setting 'session_cookie_path' = '/' to the web context everything works very well. One may use manager and view the protected pages at the frontend in the same time, as the ACLs require. The protected pages are invisible for strangers.

I noticed this when the other person failed to login to frontend with Opera. I saw that it was receiving a cookie with path of the site_url (or base_url), so http://the-host-name.org/ instead of '/'. Opera then chose not to return this cookie back to the server and hence it didn't login.