Easier ACL. Or ACL for the 99%. Or Non-Ninja ACL.

Part of my proposal is essentially to call policies roles and eliminate the existing "authority levels/roles". The levels are only valuable if you need users in the same user group with different capabilities, but the ability to do that just confuses people more, and it's so rarely needed that I don't think it's worth it.

In my scheme, roles would be lists of permissions and would determine what you can do and see as they did in Evolution.

I suspect that nothing at all is going to happen to permissions until MODX 3, so don't hold your breath.

Quote from: BobRay at Nov 19, 2014, 05:45 PM

Part of my proposal is essentially to call policies roles and eliminate the existing "authority levels/roles". The levels are only valuable if you need users in the same user group with different capabilities, but the ability to do that just confuses people more, and it's so rarely needed that I don't think it's worth it.

In my scheme, roles would be lists of permissions and would determine what you can do and see as they did in Evolution.

I suspect that nothing at all is going to happen to permissions until MODX 3, so don't hold your breath.

Hi Bob, I absolutely agree with the approach, although I think we can still do something way before MODX 3

I remember seeing the video on Vimeo just over a year ago, and I was thinking that if we want to get the best of both worlds, and not make a change which breaks sites that use ACLs, we go with your policy roles view as the default, then then have an advanced tab where you can override the default "authority". The default view would hide the complexities, yet they would still be available. Put a description in the Advanced tab that says that there is a valid, yet "relatively rarely" used use case where you may want to override the default authority.

Just my two cents.

Regards,
Tom

It might be possible to implement that inside a wizard. I usually don't approve of wizards for MODX, but this might be an exception.

Watched the video. Thanks Bob. Got a few insights there.

• Particularly the two groups of Policies - Context (overall Manager control stuff) and Objects (specific targeted Resources/Elements/Media etc).
• And the need to ensure the Developer/Admin has all the permissions for each User Group. So stuff doesn't disappear because only the 'lower order' user has been given explicit permission to see/do stuff. Discussed in part from 40:30 to 41:30.
• And that permissions are added not taken away (to higher (lower numbered) authority Roles).
  
• And the need for mgr AND web ACLs otherwise without Web the Resource tree will be empty. With the extreme case that without the (Anonymous) User Group explicitly giving permission to Load resources the website would be dead in the water for all Visitors.
  
• Which leads to the comment from the audience around 39:00 such that to stop some group seeing something you don't necessarily change their permissions you simply GIVE permission to load etc to a higher authority (lower role number). Hope I've got that correct.
  

The impatient can watch the summary from 49:25.

2.3 is the same
Wish I'd put this on the General thread. May have got more debate as I've just checked 2.3 and although it looks a bit different it appears to work the same.


Holding Breath for a pre MODx3 Change
My suggestion requires no coding (probably) and gets rid of Roles from everyday use and removes the need for Duplicate Policy Templates and Duplicate Policies (for the 99%). Simply have a Content Editor that is actually useful available by default. Those measures could reduce the complexity for a newbie of adding one general editor by around 90%. Hours or days of effort down to minutes?

Bob, can you and Susan twist a few arms? Assuming you think my plan makes sense.

I can't speak for Susan, but I think she would say the same thing. Although I'm very active on the forums, I don't have many opportunities to do any arm twisting. I'm not part of the development team and I'm not involved in the discussions on where MODX is going unless I offer unsolicited advice -- which I don't do very often. In many cases, there are technical reasons why an idea that seems both easy and brilliant is incompatible with the underlying architecture.

With respect to security permissions -- I know the rules, but I don't fully understand how they are implemented in the architecture of MODX (though I have some guesses), so I know I'm not on solid enough ground to be twisting any arms.

I've made my suggestions for MODX 3, and as far as implementing them in 2.3, I think the team is stretched thin enough that it's not likely to happen. That's why I've been thinking about a wizard that could be installed as an extra.

There's already a Content Editor policy and it's a fairly trivial job to check more permissions on it so it does what you want (or, better, duplicate it and give the duplicated policy more permissions).

Okay Bob, I'll see if I can direct a developer here to give their take.

This has already been gone over several times. It's too complex, too much embedded into the core to make any major changes in the MODX 2 (Revolution) code base at this point.

It's not all that complicated:

Policy template - all permissions possibly necessary for the user - you can even use the Administrator template if you want to.
Policy - based on the template only with checkboxes, check the permissions to allow, clear the checkboxes for the rest.
Group - must have the desired policy for each context. May or may not be the same policy for all contexts.

You can specify minimum role for everything and everybody as "member" or "super user" as you please, just make sure it's always the same. Otherwise ignore it.

Don't edit one of the existing policy templates or policies, duplicate one or create your own.

Hi Susan,

Not asking for any code changes. That's the clever bit.

Just rows in a database, or XML file or however the pre-built in Policies are stored. And probably an Editor Group too to help steer folks away from Roles as far as possible. It won't be code.

So everybody gets a useful ContentEditor that does the stuff 98% to 99% of websites need.

As the wise man said: "Don't make me think".

Either this



Or this

[ed. note: goldsky last edited this post 11 years, 10 months ago.]