Hi everyone,
the website i'm developing has a certain number of reserved pages with a user group called "Publisher", connected with its respective access rules for context and resource group "Pannello Utente". I followed the classic guide
http://rtfm.modx.com/display/revolution20/Making+Member-Only+Pages and everything worked fine...
In this website, every member user can upload several pdf files, which have to be seen only by its owner (i've already set properly the PDF content type).
At upload time, I use this code for creating a new user group associated with the current user, inserting user in the user group, creating resource group associated to the user group just created and setting its respective access rules for web context and resource group.
$id = $modx->user->get('id');
$name = $modx->user->get('username');
$group = $modx->getObject('modUserGroup', array('name' => $name));
if(!$group){
$group = $modx->newObject('modUserGroup');
$group->set('name', $name);
$group->save();
$modx->user->joinGroup($name);
}else echo 'GROUP exists. ';
$res_group = $modx->getObject('modResourceGroup', array('name' => $name));
if(!$res_group){
$res_group = $modx->newObject('modResourceGroup');
$res_group->fromArray(array('name'=>$name,'private_memgroup'=>0,'private_webgroup'=>0));
$res_group->save();
}else echo 'RES_GROUP exists. ';
$doc_folder = $modx->getObject('modResource', array('alias' => $id.'-uploads'));
if(!$doc_folder){
$upload_doc = $modx->getObject('modResource', array('alias' => 'uploads'));
$upload_id = $upload_doc->get('id');
$doc_folder = $modx->newObject('modResource');
$doc_folder->fromArray(array(
'alias' => $id.'-uploads',
'pagetitle' => $id.'-uploads',
'longtitle' => $id.'-uploads',
'description' => $id.'-uploads: cartella di upload utente',
'parent' => $upload_id,
'isfolder' => 1,
'createdby' => $id
));
$doc_folder->save();
$doc_folder->joinGroup($res_group);
//set the resourceGroupAccess policy
$resourceGroupAccess = $modx->newObject('modAccessResourceGroup');
$resourceGroupAccess->set('target', $res_group->get('id'));
$resourceGroupAccess->set('principal_class', 'modUserGroup');
$resourceGroupAccess->set('principal', $group->get('id'));
$resourceGroupAccess->set('authority', 9999);
$resourceGroupAccess->set('policy', 4 ); // 4 for Load, List and View
$resourceGroupAccess->set('context_key', 'web');
$resourceGroupAccess->save();
//set the contextAccess policy
$contextAccess = $modx->newObject('modAccessContext');
$contextAccess->set('target', 'web');
$contextAccess->set('principal_class', 'modUserGroup');
$contextAccess->set('principal', $group->get('id'));
$contextAccess->set('authority', 9999);
$contextAccess->set('policy', 4 ); // 4 for Load, List and View
$contextAccess->save();
} else echo 'DOC_FOLDER exists. ';
This code works and sets up everything properly.
After that, i created a new static resource for a test pdf file, that is shown correctly.
The problem is that, even protecting the static resource with its respective resource group, it's visible to anonymous users. This problem appears now also with protected resources in "Pannello Utente" resource group.
Did i make some configuration mistake in setting up all this stuff? How it is possible that anonymous users can see these protected resources?
☆ A M B ☆
