Granting Content Editor to a user for Specific Resources

Hi, all.

I've hit a snag with one of my MODX sites... I have created a user within the environment and now I need to allow that user to log in to the Manager UI and have access to a select set of Resources (no Elements or Files) in order to edit content and save them. The user can not be allowed to create, publish, unpublish, or delete resources, and they can not be allowed to have ANY access to administrative functions for the site as whole.

I found some pages from BobRay about adding users, but it gives them far too much privilege. And, I can't seem to find anything that discusses how to grant this sort of very restrictive access.

Thanks in advance for any pointers.

First of all, does the user really need to log in to the Manager? They can create and edit specified resources in the front end with NewsPublisher, and it's really easy to keep them from publishing, unpublishing, or deleting them. It's generally easier for them and much easier for you. So, if that's all you need, it would avoid a lot of messing with permissions.

Assuming that you *do* want the user in the Manager . . .

Your user needs to be the only user in a user group.

You need to duplicate the administrator policy (for use with that user) and edit the duplicate policy to uncheck the permissions the user shouldn't have.

Then, create a Context Access ACL entry for the user group with a Context of 'mgr' and the policy you just created.

You'll may also need Resource Group ACL entries and a duplicate of the Resource policy to use in them, but that should wait until you do the step above and see what you need.

Thanks for the response...

Do they NEED to be in the Manager, probably not. However, this is to update a handful of resources from a mobile phone, and I'm looking to do this via the Handyman extension. Since that formats things pretty well for the small screen, it should work very well. BUT, it's basically a Mobile theme for the Manager. So, into the Manager we go.

I've done basically what you outlined, but the user has the ability to edit ALL resources. I need them to be able to edit only specific ones.

FYI, you can use your own CSS for NewPublisher, so it could do that as well -- and only show them the fields you want it to.

For work in the Manager, this is the simplest option, and might do what you want.

Put the resources they *shouldn't* see in a Resource Group and connect that Resource Group to the Administrator user group (which presumably, they're not members of) with a Resource Group Access ACL entry with a Context of 'mgr' and a Policy of 'Resource'.

That will hide those resources from the users. If you add new Resources that should be protected, you'll have to remember to add them to the Resource Group (or use the defaultResourceGroup plugin to do it).

NewsPublisher is about the best option right now. You could even load TinyMCE into it if you wanted. Handyman is pretty cool, but it relies on markdown syntax. If you are giving this to a client to edit, they may not enjoy that method.

While I can appreciate how the NewsPublisher might have some advantages, I'm not looking to have to write CSS specifically to create a mobile view.

Good point. I don't blame you. Maybe someday someone will create some mobile-friendly CSS for NewsPublisher.

I'm still tinkering with this, and thought of the NewsPublisher again... But, I'm wondering if it would even be an option for me.

The rendered page is created dynamically from variables on child pages. The child pages are not directly rendered, but they are the ones that need editing. Would this even work?

You'd have to edit all the child pages separately.

Is it necessary to store the data in other pages? Typically, that sort of thing is done with either TVs or by extending the modResource object.

Editing the child pages individually is what I want. But, there's nothing in the "Content" field of any of them - they are simply "containers" of values that are set for different TVs, and the page title represents an item that the values are to be associated to. When the parent page builds the content, it displays rows of information using the title of the page in one column and each of three TVs in additional columns.

The child pages have no content and are not actually rendered. So, there would be no way to access them via the web site to get the NewsPublisher access to update them.