We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
MODX Community Forums Archive

little help with ACLs pls

    • 22656
    • 121 Posts
    papachumba Reply #1, 14 years, 6 months ago
    Basically my requirement is to setup a new editor user and give them access only to ONE folder in the site's tree structure - sounds simple! They should be able to login and modify/add/delete pages only within this folder.

    I have followed the tutorial on ACL, and I have created a new "resource group", then dragged my folder into this resource group. Now I face a few problems actually.

    • I have to add my own username to the same resource group, otherwise the folder dissapears and i cannot see it any more. - how to solve?
    • as soon as I drag the folder into this resource group, it dissapears from the frontend, ie anonymous users cannot see that whole section any more - how to solve?
    • When I log in under this new user they can see the full resource tree! How do I ensure they can only see my chosen folder? I thought dragging and dropping resources acomplished this! Why was i dragging? lol

    any help appreciated
      • 3749
      • 24,544 Posts
      BobRay Reply #2, 14 years, 6 months ago
      1. Adding yourself to the user group is the correct thing to do. (Or make yourself a sudo user if you have the newest version of MODX).

      2. Make sure all the Resource Group Access ACL entries are for the *mgr* context. Then they will not affect the front end.

      3. You need to add *all* the resources on the site to a resource group and create an ACL entry linking that group to the Administrator User Group with a context of mgr and a minimum role of super user. That will hide all the other resources from the user when they are in the Manager.

      The DefaultResourceGroup plugin will put all future docs in that group automatically.

      Here's a snippet called AllDocs that will put all existing resources into an existing group:

      <?php
/* AllDocs snippet */

/* Puts all resources on the site into the existing
resource group specified by &group (default: AllDocs) 

Example Usage: [[!AllDocs? &group=`MyGroup`]]

*/
$docGroup = $modx->getOption('group',$scriptProperties,'AllDocs');

$docs = $modx->getCollection('modDocument');

echo '<h3>Processing Resources</h3>';
foreach ($docs as $doc) {
   echo "Adding:"  . $doc->get('pagetitle') . ' to group: ' . $docGroup;
   $doc->joinGroup($docGroup);
   
}

return "Finished";


      (Argghh. There's supposed to be a br tag in front of the word Adding but the forum won't show it.)



      ------------------------------------------------------------------------------------------
      PLEASE, PLEASE specify the version of MODX you are using.
      MODX info for everyone: http://bobsguides.com/modx.html [ed. note: BobRay last edited this post 14 years, 6 months ago.]
        Did I help you? Buy me a beer
        Get my Book: MODX:The Official Guide
        MODX info for everyone: http://bobsguides.com/modx.html
        My MODX Extras
        Bob's Guides is now hosted at A2 MODX Hosting
        • 22656
        • 121 Posts
        papachumba Reply #3, 14 years, 6 months ago
        excellent Bob, thanks for taking the time to point me in the right direction. I had a feeling it had something to do with dragging all the other resources into a separate group. I guess this then removes access rights for my editor to those documents which they shouldnt see, in my case most of the site. The plugin then ensures every new document also goes to the same group.

          • 22656
          • 121 Posts
          papachumba Reply #4, 14 years, 6 months ago
          mkay, im back! gosh i feel so stupid today.

          I am still having problems with this unfortunately. Whatever I do i cannot get this particular user to see any resources in the tree once logged in.

          This is what I did:
          Created a user called "Rep"
          Created a role called "Reps"
          Created a user group called "Reps" with authority 60
          Created a resource group called "Reps editors"

          Under "user" settings, added "Rep" to "Reps" user group with a role of "Rep"
          Under "access controls/user groups" ensure Rep is sitting in Reps group, and also added my own username under the same group, then go to "update user group" for Reps.

          On "update user group" screens, did the following:
          Users:
          Rep with role of "Reps"
          myuser with role of "Super User"
          Context Access:
          Context - MGR, Minimum Role -" Reps (60)", Access Policy - "Content Editor"
          Context - WEB. Minimum Role - "Super User", Access Policy - "Administrator"
          Resource Group Access
          Resource Group - Reps Editors, Minimum Role - "Editor", Access Policy - Resource, Context Web
          Resource Group - Reps Editors, Minimum Role - "Super User", Access Policy - Resource, Context Mgr

          On "Resource Groups" tab
          Dragged a few documents into "Reps editors" user group

          Logged in as "Rep", i get a blank resource tree.
          I have tried cycling through all possible options on context access and resource group access tabs for reps user group, adding web / mgr context with different minimum roles and access templates. No matter what I do I cannot see the documents I am supposed to see when I log in under this user.

          What am I doing wrong?

            • 22656
            • 121 Posts
            papachumba Reply #5, 14 years, 6 months ago
            Wow, love it, 2nd week of fun with ACLs.
            I've managed to get it all working how I want, it seems, by the old trusty method of changing and clicking menus and haphazardly changing options until it works how I want it to work. smiley Apart from one minor niggle.

            Everything works, when a "rep" user logs in they can only see the blog section and nothing else.
            When a normal admin user logs in they can see everything.

            DefaultResourceGroup plugin is installed and works. All my documents have been moved to the "Default" group. Blog is belonging to both "Default" and "Reps editors" resource groups.

            This is the only problem left: If I try and create a new resource under the blog section as a Rep, and click save - the page starts saving and displays "saved" message, however immediately after it comes back with:
            "Error! Resource not found with ID: xx"

            After this procedure I can see the page under the admin account - it is there and assigned to "Default" user group, but not under "reps", even though a "rep" user created the page?

            I have a suspicion the DefaultResourceGroup plugin kicks in at saving stage and tries to attach this document to "default" resource group. All good and well but what about the reps group?

            Basically when an admin user saves, the plugin should kick in and move the doc to "default" group.
            However when a rep user saves, the doc should be moved to both "default" and "reps" groups.
            I presumed this was going to be done automatically, as rep is the one who created the document in the first place.
            Any ideas?
              • 22656
              • 121 Posts
              papachumba Reply #6, 14 years, 6 months ago
              Just to help others who are in the same boat, and perhaps myself, im attaching a screenshot of all my settings...
                • 22656
                • 121 Posts
                papachumba Reply #7, 14 years, 6 months ago
                Wooohooo! its all working now. Today afternoon I managed to bring the whole site down, 2 times whilst doing this. Adding all documents to a new resource group and then messing with permissions can do this!

                The only issue left over was to do with resource groups. Depending on what user is saving the document, and depending on where the document is, different resource groups are attached to said document on save. So,

                User / Document to be saved / Resource Group attached
                Admin User / Blog Document / Default & Reps editors
                Admin User / Any other / Default only
                Rep User / Blog Document / Default & Reps editors

                Logic above will ensure Reps only see what is under my blog section, and regardless of where admins save their docs they will always have correct resource groups attached.

                Bobray, i tweaked your plugin for this:

                if ($mode != modSystemEvent::MODE_NEW) return;

$parent = $resource->get('parent');

//if parent is "Blog" then also add to "Reps editors" group
if ($parent==2){$success = $resource->joinGroup('Reps editors');}
$groupSetting = $modx->getOption('drg_groups', $scriptProperties, null);

if (!empty($groupSetting)) {
   $groups = explode(',',$groupSetting);

   foreach ($groups as $group) {
      $success = $resource->joinGroup(trim($group));
   }
}
                  • 18373 ☆ A M B ☆
                  • 3,141 Posts
                  Mark Hamstra Reply #8, 14 years, 6 months ago
                  Great to hear you managed to solve your issues, and thank you very much for sharing your solutions, as well!

                  As for this post, I assume the issue was this:
                  Context - WEB. Minimum Role - "Super User", Access Policy - "Administrator"
                  A super user (role = 0) is higher in rank than your Rep (60), so they wouldn't get that permission and wouldn't see the web context / resources.
                    Mark Hamstra • Developer spending his days working on Premium Extras and a MODX Site Dashboard with the ability to remotely upgrade MODX and extras to make the MODX world a little better.

                    Tweet me @mark_hamstra, check my infrequent blog at markhamstra.com, my slightly more frequent ramblings at MODX.today or see code at Github.