Access Policies broken in 2.2.8

I've now seen this on a fresh install of 2.2.8 and an upgrade from 2.2.7. When I create a new "Manager" access policy, I usually just duplicate the "Content Editor" policy and modify it based on the user's needs. However, as of 2.2.8, they are being granted ALL privileges no matter what is selected in the new policy.

When I set up the new user group, and give them a "mgr" context with policy "Manager" it shows the correct settings for what they should have access to. However if I reopen that policy, it shows they have ALL the privileges. If I reselect "Manager", the list goes back to normal, but saving and reopening results in the same issue.

This is a big problem, as we have a site with multiple contexts and tight user control. We can't have it granting all privileges to all users.

I am running on a Centos 6.3 server with PHP 5.3.3 and MySQL 5.1.

Are you flushing Permissions and flushing all sessions after making the changes?

Thanks for the reply Bob. Unfortunately, I've flushed the permissions as both the admin and the manager (who shouldn't have that ability).

The weird thing that is going on in the database is that all the other group policies only have the permissions that equal true. When I look at the custom one I set up, it has both true and false for all its policy permissions.

I thought the simple fix would be to temporarily sanitize it by removing all of the "False" permissions. After doing that though, it showed that I had 0 permissions on that policy.

I could possibly be mod_security preventing the policy from saving correctly (though you'd usually see an error message with that).

My only other thought is a mismatch between the various date/time settings (Php, MySQL, and MODX).

I just found 5 sites with 0 media source admin policies in the template, and 7 in the media source user template.

I had previously fixed 3 of these sites back when it first went gorked in 2.2.6 and lost policies, but the other two are brand new cloud dev sites.

Something's certainly amiss again. You can replace the 7 policies in the admin template, and delete the admin policies from the user template (should have 4 policies I believe) if you are seeing the same thing.

Halfway there, syncing time fixed most permissions, but now media source policies don't work... gerrr