Rights Management for Components

Hi,

im using a 3rd party component (likedislike) which returns in the manager the list of liked/disliked resources with some statistics. My modx setup is hosting a lot of sites using a context for every site and giving the users access to their own context/site only. This plugin now is showing all the resources of every context what is not the desired behaviour. It should show only the resources of the context the user has access to.

My question is if i can solve this with modx (roles, resource groups etc.) or has this to be changed in the code of the component and when yes, where to start?

Best,

Mike

The plugin is probably getting the resources directly from the DB with $modx->getCollection(), which would bypass the permission system. You would probably have to modify the plugin.

If you just want the resources for the current context, it would be relatively simple to add that as a criterion to the getCollection() call.

The current context is available with:



and adding 'context_key' => $currentContext as a criterion for getCollection() would get you only resources from that context. Feel free to paste the code used with getCollection() here.

If you need to check the user permissions for individual documents, it's more complicated.

Quote from: BobRay at Feb 25, 2013, 02:26 AM

The current context is available with:

$currentContext = $modx->context->get('key');

Hi,

thank you for your answer.

Im using this for the frontend already where it is doing it's job fine but in the backend it seems it's always returning "mgr". I digged some more into the code and i think what i need is a method which returns the contexts the logged in user has access to.

Best,

Mike

Yes, you'll always get 'mgr' in the back end.

The thing to do is to create Context Access ACL entries exactly like the ones you use for the front end, but with a context of 'mgr'. That should hide all resources in the Contexts the user doesn't have permission for in the Manager.

Be sure to flush permissions and sessions on the Security menu before testing.

Hi,

i already did this so the user can only see the resources of his own context in the resource tree but the plugin i guess is bypassing this as you already mentioned. In https://github.com/artdevue/LikeDislike/blob/master/core/components/likedislike/processors/mgr/likedislik/getcategories.php the plugin collects all the resources from the DB. I think i need the filter here to which contexts the logged in user has access to, to modify the query but i did not find a method for this yet.

Best,

Mike

Looking at that code, I don't see any easy way to do what you want. If the getCollection() call were getting Resources as I originally thought, it would be possible, but it's getting a custom class that doesn't appear to contain any context information.

[update] I see that there's a reference to the issue here: https://github.com/artdevue/LikeDislike/issues/8

Hi,

right now im playing around with



to get what i want. When i have the context, i can use it to show only the votes for this.


Best,

Mike