Quote from: BobRay at Sep 18, 2013, 12:28 PMYou should be able to remove *all* RGA entries with a front-end context. That should allow everyone to see everything in the front end and shouldn't restrict Manager access to anything -- as long as you remove them all (then flush permissions and sessions).
If that works, I think you can eliminate the "Access Denied" problem by taking away their CA entries for the contexts that give the errors. That should hide the web and DE folders in the Manager. Blogger1 won't see any resources in the tree unless they're outside they're outside the 'web' context. I'm not sure if that's what you want.
Hi Bob,
i dropped all the RGA entries with front-end contexts as recommended so ended up with RGAs like this (other policies and access settings remained unchanged):
Administrator User Group
RGA
blog_only Member - 9999 Resource mgr
site_content_and_blog Member - 9999 Resource mgr
User Group
RGA
blog_only Super User - 0 Resource mgr
blog_only Blogger - 8000 Resource (Bloggers) mgr
User Group
RGA
site_content_and_blog Super User - 0 Resource mgr
site_content_and_blog Content_and_Blog_Editor - 7000 Resource (Bloggers) mgr
i can see all the front-end content + blog while i am logged out from Manager or when i'm logged in as admin
when logged in as "blogger1" or "editor1" i see in front end
"The webpage cannot be found"
for all content and blog
:(
kr
MODX Revolution 2.2.8-pl (advanced)
Extras:
archivist 1.2.4 | Articles 1.7.1 | Babel 2.2.5 | getpage 1.2.3 | getresources 1.6.0 | quip 2.3.3 | SimpleSearch 1.6.1 | taglister 1.1.7 | TinyMCE 4.3.3 | Wayfinder 2.3.3
PHP Version 5.6.20-0
MySQL Version 5.5.31
Make sure that all user groups, including (anonymous), have Context Access ACL entries that give access to all front-end contexts with a policy of "load only".
Quote from: BobRay at Sep 19, 2013, 04:53 PMMake sure that all user groups, including (anonymous), have Context Access ACL entries that give access to all front-end contexts with a policy of "load only".
Hi again, Bob,
adjusted CAs & RCAs as per your recommendation - see below:
(anonymous) User Group
Users
none
CA
web Member - 9999 Load Only
DE Member - 9999 Load Only
FR Member - 9999 Load Only
RGA
site_content_and_blog Member - 9999 Resource web
site_content_and_blog Member - 9999 Resource DE
site_content_and_blog Member - 9999 Resource SE
site_content_and_blog Member - 9999 Resource SK
User Group
Users
admin Super User - 0
CA
mgr Super User - 0 Administrator
web Super User - 0 Administrator
DE Super User - 0 Administrator
FR Super User - 0 Administrator
mgr Member - 9999 QuipModeratorPolicy
RGA
blog_only Member - 9999 Resource mgr
site_content_and_blog Member - 9999 Resource mgr
User Group
Users
admin Super User - 0
blogger1 Blogger - 8000
CA
mgr Blogger - 8000 TEST Content Editor
web Member - 9999 Load Only
DE Member - 9999 Load Only
FR Member - 9999 Load Only
RGA
blog_only Super User - 0 Resource mgr
blog_only Blogger - 8000 Resource (Bloggers) mgr
User Group
Users
admin Super User - 0
editor1 Content_and_Blog_Editor - 7000
CA
mgr Content_and_Blog_Editor - 7000 TEST Content Editor
DE Member - 9999 Load Only
web Member - 9999 Load Only
FR Member - 9999 Load Only
RGA
site_content_and_blog Super User - 0 Resource mgr
site_content_and_blog Content_and_Blog_Editor - 7000 Resource (Bloggers) mgr
now only anonymous and admin can see front-end content and blog
bloggers & editors cannot see in front-end anything and even their back-end Resource browser is empty
kr
[ed. note: krajicek last edited this post 13 years ago.]
MODX Revolution 2.2.8-pl (advanced)
Extras:
archivist 1.2.4 | Articles 1.7.1 | Babel 2.2.5 | getpage 1.2.3 | getresources 1.6.0 | quip 2.3.3 | SimpleSearch 1.6.1 | taglister 1.1.7 | TinyMCE 4.3.3 | Wayfinder 2.3.3
PHP Version 5.6.20-0
MySQL Version 5.5.31
Try removing all the RGAs for the (anonymous) group. That's what's protecting the resources from everyone else. Once those are gone, the all the resources should be unprotected for everyone in the front end.
As usual, flush permissions and all sessions after the change.
Hi! I've this situation: I´m working in a website for a designer friend, and i want the clients be able to create users ( site admins ), so i create a usergroup, create my own Policy Template, and assigned it to the created usergroup. Create a user in this usergroup. In that custom policy i give them permissions to create, edit users, but when i log in ( in other browser ) with the new user, i noticed that i can EDIT the main admin account. I uncheck the "edit user" permission for the custom policy template, clear cache, flush all sessions, and when i log in with the cliente user, i can´t see the content of the Security Tab. I read one by one all the 172 permissions.
So, this is what i need to do: I want the client to be able to insert and edit users ( people that will admin the content of the website ), but can´t edit my super admin account, so if there is some trouble in the future, i cant login and fix it. Thanks!
P.D. I tried roles too...
zzseba, you should start a new thread with your question rather than hijacking this one.
