can't make document tree visible to restricted user

First time MODX user. I had no trouble porting an existing site into MODX and really like how that all works. Security has defeated me however. I've spent several hours going through tutorials and browsing forum threads, and have not been able to figure out how to make what I want to do work. Sorry for the newbie problem. I have a rather simple requirement. The site has a small number of text paragraphs that need to be maintained regularly (currently just two). I put the two text segments into chunks, created a user to do the editing, and want him to log into the mgr context and see only those two items. (I don't care if he sees other docs, but only has read access to them.) When I log in as this user the document tree is not visible, and hence the two chunks are not available.

Being new to this, I'm not sure what you need to know, so I'll list as much as I can about how I set it up without giving full detail. Note that I understand that many items may not be needed but have arrived at this point by trying many things that I knew may or may not work.

1) used modified dashboard to reduce clutter as much as possible. This appears to work correctly and changing back to the default dashboard does not fix the problem.
2) created two categories with the two chunks in category1 and everything else in category2.
3) created new access policy called editor_1 from the administrator template. activated permissions:
change_password, change_profile, components, content_types, countries, credits,
dashboards, edit_chunk, edit_document, edit_locked, element_tree, frames, help,
home, list, load, logout, menu_reports, menu_site, menu_support, menu_tools,
menu_user, new_chunk, resource_duplicate, resource_tree, save, save_chunk,
save_document, source_view, tree_show_element_ids, tree_show_resource_ids,
view, view_chunk, view_document, view_element
4) created new role called editor_1 with authority 5.
5) created new resource group called full_view_access and placed ALL of the resources listed
in the web context into this group.
6) created new user group called content_editor_1 which contains both admin and the new user.
6a) both admin and the new user assigned role editor_1.
6b) context access for mgr: min role -- editor_1 and access policy -- editor_1.
6c) resource group access for full_view_access: min role -- editor_1;
access policy -- resource; context -- mgr
6d) element category access for category1: min role -- editor_1; access policy -- element;
context -- mgr
for category2: min role -- editor_1; access policy -- element; context -- mgr

I'm stuck. Haven't yet developed an intuition about how all these pieces fit together and at this point I'm just trying permutations of the above.

Please help.

TIA, Rick.

Is the resource tree completely missing, or just empty? If it's empty, the odds are that you didn't create a Context Access ACL entry for the user with a context of 'web'. That's necessary for the user to see any resources in the 'web' context in the tree.

It's a common error because in all other cases the 'web' context refers to the front end, not the Manager.


------------------------------------------------------------------------------------------
PLEASE, PLEASE specify the version of MODX you are using.
MODX info for everyone: http://bobsguides.com/modx.html

Thanks very much for your reply.

The resource tree is completely missing. No icons, no tabs, no root nodes or anything else.

From my reading, I knew about needing entries for the web context and have corresponding entries for context 'web' for everything listed in my step 6 with exactly the same settings otherwise. Didn't dawn that it made a difference, so didn't list them. Specifically, there is a context access entry for context 'web' with settings: min role -- editor_1 and access policy -- editor_1.

I'm using a new install of Revolution 2.2.4-pl. My service provider made it available through an installation service www.simplescripts.com, so I had (have) no access to the installation settings.

Thanks again, Rick.

This is going to sound goofy, but try turning off the compress_js and compress_css System Settings and then manually delete all files in the core/cache directory. On some platforms those settings can lead to missing stuff in the Manager. It's a long shot, but good to eliminate as a possibility.

I don't see anything wrong with your setup, but the next logical step would be to enable all permissions in the editor_1 Context Access policy and flush permissions and settings. If that solves it, you can start unchecking permissions, a few at a time, to find out which ones are necessary to see the Reource tree.

If that doesn't solve it, I think the next step would be to download your own version of MODX (from modx.com) and do an upgrade install. You shouldn't lose any of your work, and I have seen a couple of other reports of people having trouble with a SimpleScripts install of MODX.


------------------------------------------------------------------------------------------
PLEASE, PLEASE specify the version of MODX you are using.
MODX info for everyone: http://bobsguides.com/modx.html

OK, I am happy to report that I've had general success at getting this set up. It's an exercise in what's the minimum needed to set up a manager to edit a specific set of chunks, hopefully not seeing anything else. There are a couple of problems that I would like to clean up (see end of post). Here's what I currently have set:

1) used modified dashboard to reduce clutter as much as possible

2) created two categories with the two chunks to be edited in category1 and everything else in category2.

3) created new access policy called editor_1 from the administrator template with activated permissions:
change_password -- change_profile -- edit_chunk -- element_tree -- frames -- help -- home -- load (note that list does not seem to be needed) -- logout -- menu_site -- menu_support -- menu_user -- resource_tree (note not sure why this is necessary but element tree does not work without it) -- save_chunk -- view_chunk

4) created new role called editor_1 with authority 5.

5) created new resource group called full_view_access and placed ALL of the resources listed
in the web context into this group. (Don't understand resource groups yet, so don't know how this affects everything else.)

6) created new user group called content_editor_1 which contains both admin and the new user.
6a) both admin and the new user assigned role editor_1.

6b) context access
mgr: min role -- editor_1; access policy -- editor_1
web: min role -- editor_1; access policy -- editor_1

6c) resource group access for full_view_access:
mgr: min role -- editor_1; access policy -- resource
web: min role -- editor_1; access policy -- resource

6d) element category access
category1: context -- mgr; min role -- editor_1; access policy -- element
category1: context -- web; min role -- editor_1; access policy -- element
category2: context -- mgr; min role -- member; access policy -- load only
(note: "load only" is required to make category2 chunks disappear from the manager)
category2: context -- web; min role -- member; access policy -- list, load and view

So, my new user can log in.
(1) He sees both the resource tab and element tab. When the resource tab is clicked there is nothing in it (that's good). I would like to make the resource tab disappear. When I set permission "resource_tree" to false the tab disappears; however the elements tab is there but it is empty. So, this permission seems to affect seeing stuff under the elements tab.
(2) My new user can also see and edit the chunks in category1 and category2 is completely missing. That's good. However, when one of the chunks is edited, and the "save" button is clicked, it DOES save it (complete with the success message) BUT immediately following the success message is an error window with "permission denied." I can't find anything wrong, and the resource containing the chunks displays correctly with the new version of the chunk. So this is not critical in the sense that it does not mean a failure in editing the chunk. It's just bad form and clunky to have a meaningless error show up.

If anyone has an idea of how to fix either of these issues, I'd be glad to hear it. I've tried everything I can think of, at least for the time being.

TIA,
Rick. [ed. note: ride2719 last edited this post 14 years, 1 month ago.]

What happens when you put "load" back in the editor_1 Context Access policy?

Double-check that save_chunk and load are checked in the editor_1 policy and everything is checked in the element policy.

I assume that you're flushing permissions *and* flushing all sessions after each change before testing.



------------------------------------------------------------------------------------------
PLEASE, PLEASE specify the version of MODX you are using.
MODX info for everyone: http://bobsguides.com/modx.html

Deleting the browser cache also is imperative. Many times I've thought something didn't work and the browser cache was to fault. Then, I don't know if what I originally tried would have worked.

Seems that sometimes all that is needed is flush permissions, sometimes you need to also flush sessions, and sometimes you gotta do all three. I haven't figured out which is which yet. Permissions still stump me.

... flush permissions, sometimes you need to also flush sessions, and sometimes you gotta do all three (third=delete cache). ...

In the cases of permissions, user groups, etc...

• You flush permissions when your OWN permissions have changed.
• You flush sessions when you've changed another user's or group's permissions.
• You delete the cache when these permissions changes could affect the content being served.

In other words, if the permissions have changed for your entire user group, you must do at least the second (it automatically does the first). If you or another admin has only changed your permissions, you may do the first. If another admin has changed the entire group and just happens to let you know while you are logged in, you may do the first.

Because many User Groups see different content, this often results in having to perform the 3rd.

Hope that clears it up!

Sometimes I have to flush permissions after installing a package with a Components menu action before it will show up in the main menu. Clearing the cache, even deleting the core/cache folders, won't do the trick.

Thank You Fuzzy! As always, you explain very well. :~}