Disallow "Create new Resource" but allow "New Article"

Hi,

i created a role where the user has a pack of resources he can edit but he should not create new ones so i disabled this feautere for the role. On the other hand the user should be able to create new articles but Articles seems to need "Create new resource" permission so my question is how to solve this problem if its even possible.

Best,

Mike

Actually, I think the permission checked is 'save_document'.

I think the way to do it (in addition to what you did already) would be to put all existing Articles in a Resource Group and create a Resource Group Access ACL entry with a policy that contains save_document permission.

I'm not sure if new Articles would automatically go in that group or not. If not, you might have to create a simple plugin to add them to the group.

[update] On second thought, that won't work if you've removed that permission from the User's Context Access ACL entry.

I think a better method would be to give the user save_document permission in the Context Access ACL entry, and put all non-Article resources in a resources group that's attached to the Administrator user group with a Context Access ACL entry. Then create a Resource Group Access ACL entry for your user's user group that doesn't contain that permission. I hope that makes sense.

As a secondary layer, restrict their ability to publish.

Have a Admin publish them instead.

Hi,

@Shawn
They should be able to publish.

@Bob
Actually the name is new_document what is needed by articles to create new ones. But the mentioned save_document brought me to the idea to create like 10 articles so the user can edit, publish and unpublish them. This is doing it for me right now though using Resource Groups is a good idea. I put that on my todo list.

Thanks,

Mike

I was basing my answer about the necessary permission on the Articles code.

There's no check for new_document permission anywhere in the Articles code, though it could be checked in a processor called by Articles.

Articles does directly check the save_document permission.

Perhaps a plugin, to check the type or class of the document the user is attempting to create or open?