First off, I just started with MODx about two days ago, and I’m very impressed! I’ve been reviewing a number of CMS’s over the past few weeks, and MODx seems to offer great functionality, without a ton of configuration overhead.
I believe I have a good understanding of how the users/roles/user groups/document groups permissions work. However, I’m running into a situation that I can’t figure out how to address under that approach. One of our requirements involves allowing people to edit sub-sub-sub pages, without allowing them to edit the parent pages.
It appears that they need access via a combination of the document group/user group in order to traverse the document tree to get down to the page that they are allowed to edit. However, there is no "Edit" or "View" property associated with these groups. So, the individual has "Edit" permissions via their role, and requires access to the whole document tree in order to navigate to the sub-sub-sub page. This appears to allow them to edit any of the parent pages, which they should not be able to do.
For a more concrete (hypothetical) example, let’s say we’re in a site where there’s a parent page ("Departments") and then some subpages ("Marketing" and "IT"). Alice, Bob and Charlie are our content editors. Alice is in charge of Marketing, Bob is in charge of IT, and Charlie is in charge of the "Departments" page, and the rest of the site.
Since they’re all editors, we give them a "Content Editor" role, which has Edit and Save permissions. Then, we create three user groups ("Marketing Editors", "IT Editors", and "Site Editors") and populate them with the appropriate users. We also create three document groups ("Marketing Documents", "IT Documents", and "Site Documents") and establish the connection with the corresponding user group.
We then assign the Marketing, IT and the rest of the site to the appropriate groups. Charlie is fine, because he can edit the site, and the Departments. However, Alice and Bob are out of luck, since the "Departments" page is part of the tree to get to their subpages, and they don’t have permission to it. If we were to add the "Departments" page to the "Marketing" or "IT" groups, they would be able to get to their subpages, but would also be able to edit the "Departments" page.
It almost seems like there’s a missing piece in the User Group to Document Group correlation, similar to the Unix rwx permissions, or documents need to be marked "public" or "private", or have a "traverse" attribute so people can drill through documents without edit permissions to get to a document for which they DO have edit permissions.
Or, I could be missing something very simple! Has anyone else encountered this situation? Or does anyone have any ideas for an approach or workaround?
Thanks!
--Tim
