We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
MODX Community Forums Archive

Answered Create manager 'admin user' but with read only rights ?

    • 40395
    • 67 Posts
    alchemy Reply #1, 10 years, 10 months ago
    Hi,

    I need to give a 3rd party access to the manager side of my site as part of preliminary discussions regarding some development. I have set up a 'editor' style account as per Bob's instructions here: https://rtfm.modx.com/revolution/2.x/administering-your-site/security/security-tutorials/giving-a-user-manager-access

    In the permissions section I unticked everything that looksed like it gave 'edit' permisions leaving all the 'view' options ticked. However The upshot is the new user can't see the structure of the site via the resources / elements / files section.

    How might I do this ?

    Cheers


    David



    This question has been answered by BobRay. See the first response.

      • 3749
      • 24,544 Posts
      BobRay Reply #2, 10 years, 10 months ago
      In order for users to see resources in the tree, they need a Context Access ACL entry for each front-end context (e.g., 'web') in addition to the one you gave them for 'mgr'.

      They'll also need resource_tree, file_tree, and element_tree permissions and probably 'load' and 'list' permission.

      You might try using the "Load, List, and View, Policy for all ACL entries and see what that gets you.
        Did I help you? Buy me a beer
        Get my Book: MODX:The Official Guide
        MODX info for everyone: http://bobsguides.com/modx.html
        My MODX Extras
        Bob's Guides is now hosted at A2 MODX Hosting
        • 40395
        • 67 Posts
        alchemy Reply #3, 10 years, 10 months ago
        Quote from: BobRay at Nov 04, 2015, 12:34 PM
        In order for users to see resources in the tree, they need a Context Access ACL entry for each front-end context (e.g., 'web') in addition to the one you gave them for 'mgr'.

        They'll also need resource_tree, file_tree, and element_tree permissions and probably 'load' and 'list' permission.

        You might try using the "Load, List, and View, Policy for all ACL entries and see what that gets you.

        Cheers Bob smiley

        I added the "Load, List, and View" policy to the 'editor' (as per your tutorial) mgr entry, effectivly:

        On the Permissions -> Context Access tab, add two new entries to the grid:
    Context: 'mgr' Minimum Role: 'Editor', Access Policy 'AdminLite'
    Context: 'mgr' Minimum Role: 'Editor', Access Policy 'Load, List and View'
    Context: 'web' Minimum Role: 'Editor', Access Policy 'Load, List and View'


        and that seemes to help. The user can new see the resources and list of tamplates but unfortunatly can not see the actual templates.

        I'm not quite sure where to make the amends you suggest in the 1st para through. The 'tree' settings were already selected.




          • 3749
          • 24,544 Posts
          BobRay Reply #4, 10 years, 10 months ago
          The problem is that without edit permission, they can't always see the actual content of the objects.

          You might try giving them everything but save_document, save_template, save_chunk, etc., or just not give them basic 'save' permission. That way they can see (and edit) everything but can't change anything permanently.
            Did I help you? Buy me a beer
            Get my Book: MODX:The Official Guide
            MODX info for everyone: http://bobsguides.com/modx.html
            My MODX Extras
            Bob's Guides is now hosted at A2 MODX Hosting
            • 40395
            • 67 Posts
            alchemy Reply #5, 10 years, 10 months ago
            Quote from: BobRay at Nov 05, 2015, 04:28 PM
            The problem is that without edit permission, they can't always see the actual content of the objects.

            You might try giving them everything but save_document, save_template, save_chunk, etc., or just not give them basic 'save' permission. That way they can see (and edit) everything but can't change anything permanently.

            Cheers Bob, that seems to do the trick. I'll need to tweak the 'file' setting but I think that should be doable.

            Thanks for your help. [ed. note: alchemy last edited this post 10 years, 10 months ago.]
              • 3749
              • 24,544 Posts
              BobRay Reply #6, 10 years, 10 months ago
              Did you remove the save_document, etc. permissions, or just 'save'?
                Did I help you? Buy me a beer
                Get my Book: MODX:The Official Guide
                MODX info for everyone: http://bobsguides.com/modx.html
                My MODX Extras
                Bob's Guides is now hosted at A2 MODX Hosting
                • 40395
                • 67 Posts
                alchemy Reply #7, 10 years, 10 months ago
                Quote from: BobRay at Nov 06, 2015, 10:52 AM
                Did you remove the save_document, etc. permissions, or just 'save'?

                Pretty much all the of the save variations were unticked. On opening a template an error did show but it's still possible to view. An attempt at a save give an permissions error.

                It wasn't possible to see the file structure although the file tab is present. It's a bit odd, as looking now, the appropriate boxes seem to be ticked.
                • discuss.answer
                  • 3749
                  • 24,544 Posts
                  BobRay Reply #8, 10 years, 10 months ago
                  If you want to, you can edit the lexicon entry that gives the "Access Denied" message (or whatever you're seeing) to say something else.
                    Did I help you? Buy me a beer
                    Get my Book: MODX:The Official Guide
                    MODX info for everyone: http://bobsguides.com/modx.html
                    My MODX Extras
                    Bob's Guides is now hosted at A2 MODX Hosting
                    • 40395
                    • 67 Posts
                    alchemy Reply #9, 10 years, 10 months ago
                    Quote from: BobRay at Nov 06, 2015, 11:42 AM
                    If you want to, you can edit the lexicon entry that gives the "Access Denied" message (or whatever you're seeing) to say something else.

                    Thanks - I didn't realise that was an option.