Access controls allowing anonymous user to see unpublished pages

Hi there,

I have an issue with pages that are unpublished and are still accessible publicly via URL.
I think its because my access controls are screwed up there.
What I got is this:

MODX 2.2.10-pl

A couple user groups including a (anonymous) one.
That (anonymous) user group has "Load only" as policy in "Context Access" and "Resource Group Access" and no policy in "Element Category Access" and "Media Source Access".

The "Load only" policy has only "load" checked.

Now when I navigate with a different browser that is not logged in and in stealth mode to an URL that is unpublished I still get to see the content of that page. (Navigating to the manager in the same browser window asks me to log in)

Any ideas what the cause of this might be?

What I did so far is include the below snippet in my header on every page:


[ed. note: dominikwilkowski last edited this post 12 years, 9 months ago.]

That is a weird one. Have you tried deleting all files in the core/cache directory? There may be cached versions of the pages that were stored when they were published.

Yeah I did that a couple times. Could there be something in the access policy that would cause this?

If the policy for the Anonymous user group has the view_unpublished permission checked, that would do it. Any Context Access ACL entry for the Anonymous group should use the Load Only policy.