Security and Account Issues.

Good evening to all. First and foremost, we think this is one K.A. product and our koodos to all involved.

Next; we do not like to yak or complain and try to provide as much information as possible to assist everyone in helping us out. So, bear with us if we are a little lax in providing some information.

Here we go;

Our history has been with DotNetNuke (DNN), Concrete5 and Umbraco no Wordpress (not in this life). The CMS systems we use are great, but the learning curve is steep and Razor can be a little messy. This looks like the perfect fit for our clients. Most are on IIS and many other are on Centos 6.x and Ubuntu 14.

Steps to date:
1) Have installed Revo 2.4.2pl on IIS 7.5,
2) Have setup a very simple 2 page test site as per the Starting Video Guides,
3) No snippets, TVs and only 4 chunks,
4) No other scripts (java, bootstrap etc),
5) Everything - I mean everything worked right out of the box - no muss, no fuss,
6) We can successfully move the ModX install from one server to another (following all the guides and tuts),
7) So far all good - no an issue or error anywhere. We've saved the site and DB, then we proceeded to the next step,
8) Followed the guide on "Hardening ModX' and have this guy locked down pretty good,
9) We've been able to successfully move the "Core" folder and those sorts of things,
10) With all the above in mind, we restored the original test site - ALL GOOD.

Now, before we venture off on 3 projects that we want to port over, we figured best to work on the Security. Specifically, creating accounts for our client so they can add/edit and manipulate content.

In every tut, guide and even the Revo docs, there is a reference to the "Security Tab" or "Security Menu". We have no such animal anywhere on any menu at all.

We understand the concept of ACLs, roles, groups etc. That is not the problem.

We think we have figured out some of the steps, but they seem convoluted as we have to bounce around from one menu to another, right click this and that. It is a little confusing so we thing we are messing with our own minds and not getting something.

So the question we have is "What are we missing" and/or "How do we enable the Security Menu"?

If I've missed anything, please let me know and I will be happy to provide it.

I'm afraid you have run afoul of MODX outpacing its documentation.

Users are managed in Manage -> Users.
Groups, policies, etc are managed in Admin (the little gear on the right) -> Access Control Lists.

I view the MODX Manager much the same as I did when mouse-driven games took over from text and command-line games, hover over, click and right-click on stuff because you never know what it's going to do!

Quote from: sottwell at Jan 21, 2016, 10:47 PM

I view the MODX Manager much the same as I did when mouse-driven games took over from text and command-line games, hover over, click and right-click on stuff because you never know what it's going to do!

Yes indeed. Your previous reply is what we had found and are moving forward with the adventure of implementing Authors/Editors etc.

Are there any suggestions (or docs) that you may have or recommend?

I ask only because the posts and articles that we have reviewed and reference are quite outdated.

Thanks again for the "Intel".

Cheers.

http://bobsguides.com/modx.html. Click on MODX -> MODX Security Permissions. Some of the Manager commands may be out of date, but it sounds like you know where things are.

There is also this 50 min. video explaining the MODX Revolution permissions system from the inside out.

Quote from: BobRay at Jan 23, 2016, 02:00 PM

http://bobsguides.com/modx.html. Click on MODX -> MODX Security Permissions. Some of the Manager commands may be out of date, but it sounds like you know where things are.

There is also this 50 min. video explaining the MODX Revolution permissions system from the inside out.

Thanks BobRay, I managed to find an excellent series of Videos on line that were focused on ModX Revo. I did go over Bobs Guides, but found the steps and intel to be a little dated - for ex:, on the first page a step is completely blank and some of the other details were "apparently" for Evo.

In any case, we have Security in-place and have actually setup a site and using the detailed steps we developed have it working exactly ow we want.

Now the other shoe drops,

In our setup, we have the following:
1) Editors, can add pages (currently no delete - that comes later),
2) We've created an upload folder in the Site Hierarchy,
3) Under "uploads", we created 2 folders: videos and images,
4) Under Media Sources - we've removed the above group from the Root file system (i.e. just gave Administrators access),
5) We gave "editors" access to uploads (Min: member, Policy: Media Source Admin),
6) An editor can log in and uploads a file to the "uploads" folder, BUT cannot see the sub-folders (and of course can't delete at this time).

Question; What did I miss between steps 2 to 5? In other words, how do I give "editors" access to sub folders (they can't even see them).

Again, many thanks to everyone in this forum. With help here and on the interweb, we have managed to be quite successful in getting Revo installed, able to move to another server, create and secure accounts and implemented, Chunks, TVs and Snippets. The next thing on the list is a Video Gallery and Sliders - but we found an excellent site with detailed step-by-steps.

We'll figure out the "little pieces" lik sub-folders. Mostly cause we are very anal about details and documenting the bejesus for everything, but if anyone has a pointer regarding the "uploads" folder item - it would be appreciated.

Thanks again everyone...

UPDATE:

Please note that I figured out the FOLDER/Sub-Folder listing.

It helps if one updates the Correct Policy AND
-->> Don't place the folder in the Site ROOT (I meant to put it under assets).

Cheers.