User can get around permissions
Permalink
It seems like my generic registered users can get around the permissions I have set up in the page type defaults. If I go into the registered user account and add a page under a particular page that gives it access to a particular block that is available nowhere else in the site and then copy/move the page to another section of the site - they are still able to add that particular block that I thought I had restricted to one area of the site. Am I doing something wrong here or is it actually possible to get around permission settings like this in C5?
Basically, I want to be able to restrict certain page types to certain areas of the site. They should not be able to exist anywhere else. Currently, the user is only able to add these pages in one area of the site but as mentioned above, after adding the page they can then move it wherever they want.
-Aaron
Basically, I want to be able to restrict certain page types to certain areas of the site. They should not be able to exist anywhere else. Currently, the user is only able to add these pages in one area of the site but as mentioned above, after adding the page they can then move it wherever they want.
-Aaron
Thanks Techn0tic but that is actually how I currently have it set up. I have it set so that they can only add certain blocks and page types in certain areas of the site but after creating a page with those restrictions, they are free to copy/move that page to another area of the site where those blocks and/or page types should not be.
Also, I noticed that after creating a page with its permissions set in page type defaults that if I then change its design to another page type (which has different permission settings) it does not inherit the new permissions, even though it is still set to inherit from the page defaults. It will only inherit from the original page type assigned to it and the only way to change it is to either override it with manual settings or delete it and recreate it with the new page type. This isn't as big of a concern for me as the other issue but is sort of related in that it allows the user to override the settings you had originally put in place. I also tried clearing the cache here but no luck.
Any other thoughts on where I might be going wrong? Is there a setting somewhere that would allow me to restrict where certain page types can be copied/moved (i.e. they must remain underneath their current parent) and is there a way to have it so that when changing a page design, it will change its permission settings to reflect those of the new page type assigned?
Thanks!
Also, I noticed that after creating a page with its permissions set in page type defaults that if I then change its design to another page type (which has different permission settings) it does not inherit the new permissions, even though it is still set to inherit from the page defaults. It will only inherit from the original page type assigned to it and the only way to change it is to either override it with manual settings or delete it and recreate it with the new page type. This isn't as big of a concern for me as the other issue but is sort of related in that it allows the user to override the settings you had originally put in place. I also tried clearing the cache here but no luck.
Any other thoughts on where I might be going wrong? Is there a setting somewhere that would allow me to restrict where certain page types can be copied/moved (i.e. they must remain underneath their current parent) and is there a way to have it so that when changing a page design, it will change its permission settings to reflect those of the new page type assigned?
Thanks!
That's an interesting problem, I hadn't thought of moving pages around, I guess we'll have to see what's in 5.4
I have noticed that the page-type defaults only seem to be applied when the page is first created, I guess the page keeps it's own instance settings when you switch the page-type.
I have noticed that the page-type defaults only seem to be applied when the page is first created, I guess the page keeps it's own instance settings when you switch the page-type.
Yeah kind of a bummer.
Hi Aaron,
There are lots of areas where advanced permissions are failing to deliver. I have started a thread in the beta forum earlier this week requesting a focus on fixing advanced permissions for 5.4.1
Hopefully the core team will have some time to look at them.
There are lots of areas where advanced permissions are failing to deliver. I have started a thread in the beta forum earlier this week requesting a focus on fixing advanced permissions for 5.4.1
Hopefully the core team will have some time to look at them.
You're right. This is a bug. It should now be fixed in 5.4.
If you edit the defaults for a page type, you can manually set the sub-page permissions (example screenshot attached).
Having done that, the page-type defaults should limit the type of sub pages that can be added.