Answered NewsPublisher: Edit Button Permissions

Revo 2.3.3
NewsPub 2.0.2

* This seems like an obvious security permission issue but I'm not sure what else to try or where to look next. I've read the NP docs and the settings appear to be correct. It's confusing because the edit button only fails under a very specific condition.

I'm trying to show the NP edit button on a member-only page that lists all the articles created by the member. The button code is in a Chunk and the Chunk is called in a getResources call on the member-listing page. But the button is missing.


Is this not possible? [ed. note: todd.b last edited this post 11 years, 5 months ago.]

Try adding &debug=`1` to the snippet tag. See what that gets you.

&debug=`1` doesn't output anything.

The button works as expected for a sudo Admin, but for Members it's missing, there is no trace of any button-related HTML in the source.

That tells us that the snippet is never executing. I was going to suggest that the problem was most likely due to nesting and the parsing order. In that case moving it up to a higher level (e.g., putting the getResources tag in the template or page content) might work.

If it works as is for a sudo user, though, that suggests a permission issue, but if a use doesn't have a necessary permission, with debug on you'll still see the button, so I'm afraid I'm stumped.

The page in question isn't the site_start page by any chance?

You might try making sure the user has edit_document, save_document, and save permission for the resource with the list of their docs. If that doesn't work (after flushing permissions and sessions), a custom snippet would be the next step.

No, the page in question is not the site_start page.

I'll try to reduce the nesting as you suggested. Maybe I'll get lucky and that will solve the problem, but my gut tells me it's a permissions issue.

Regarding permissions @BobRay:

In Menu > ACL > Permissions the only settings I have are:

Context Access: web | Member - 9999 | NewsPublisherEditor
Resource Group Access: Member | Member - 9999 | Resource | web
* I intentionally did not assign Members any Manager access policies.

Also, all the Member pages belong to a 'Member' Resource Group, including the problematic listing page.

My question: Could I be missing an ACL setting (in any of the 4 Permissions tabs) that could be causing the problem?

One last thing, aside from the button on the main listing page I'm also using the NP button on the template for the actual article which works perfectly for all users/groups. It's just the listing page that's hinky. [ed. note: todd.b last edited this post 11 years, 5 months ago.]

If the listing page is in the same resource group as the members' pages (and the button shows up on those pages), the permissions should be OK. The symptoms are typical of a nesting problem, where the edit button tag is parsed at the wrong time. But again, the fact that it works for sudo users is baffling.

@BobRay

I think I found the problem, but I don't know how to fix it.

The NP button on the listing page is only visible to the sudo because the 'listing' resource was created by the sudo.

To test it I manually changed the 'createdby' db row of the 'listing' resource from 1 (sudo) to the ID of a random Member (eg, 4) and guess what, the NP button appeared on the listing page for Member (id 4), but then it disappears for the Admin. Again, this only happens with the NP button on the listing page, the button renders fine on the article template.

It seems like a permissions issue but I'm not sure how to make the button available to all Members. [ed. note: todd.b last edited this post 11 years, 5 months ago.]

@BobRay,

Your suggestion did not work, but in addition to the previously mentioned createdby problem I found another potential cause.

The site has 3 main sections: Articles, Reviews and Tutorials. Each section has it's own NP form. The main listing page collects all the resources by section and member. So far so good.

To better organize the main listing I used a separate getPage/getResources call for each section to only show the (member-created) resources for that particular section. So far so good.

To differentiate between the 3 different sections I changed the &toPlaceholder property to represent each section (above):
Articles: &toPlaceholder=`articleResults`
Reviews: &toPlaceholder=`reviewResults`
Tutorials: &toPlaceholder=`tutorialResults`

As far as listing the resources is concerned everything works great across the 3 sections for Members and Admin, but as I've said, the button fails.

As a test I removed 2 of the section calls and used a single call (similar to below) to collect all the resources across all 3 sections. As previously mentioned the NP button appeared for Members(!) but once again disappeared for sudo.

It seems my attempt at using 3 calls is, at least in part, causing the button to fail, though I don't know why. Going forward I would still prefer to separate the listing into 3 calls so the question is, can I still do that somehow?

Below is the the call for the 'Articles' section, the other 2 sections (calls) are essentially the same, albeit with different &tpl, &parents and &toPlaceholder. Each call uses it's own Chunk (&tpl) which contains the NP button.
[ed. note: todd.b last edited this post 11 years, 5 months ago.]

Did you try this?




When the users visit their own pages, does the button show up there?