search

bmihelac / feincms-feincmsext

Extensions for FeinCMS
11 stars 4 forks source link

Users can't add pages on root #5

Closed Gwildor closed 11 years ago

Gwildor commented 11 years ago

When an user isn't a superuser, you can't give him permissions to add pages on the root; the only thing you can do is give permissions to add pages in the subtree of a page you added permissions for that user on. This should be possible, however, because you want to have users which can do everything with pages but nothing with the rest of the admin without SimplePermissions getting in the way, or simply users which can add pages everywhere, but just can't do anything else.

Best possible way to achieve this is possible to allow the page setting when adding a page permission to be set to blank, and if it's blank, assume the whole root tree.

bmihelac commented 11 years ago

I guess that if user is not listed in PagePermission model, simple_permission should not apply. Then, it should depends on regular django.contrib.auth permissions. Right?

Gwildor commented 11 years ago

Would that mean that all users will usually be able to do anything, unless they have a PagePermission set on them? That would be a good compromise, although it could be subject to security issues (for instance, when you create a new user and forget to set any PagePermissions on them, then they would be allowed to do everything they are allowed to by Django's auth). However, I think that is probably the best solution.

bmihelac commented 11 years ago

yes, new user would be able to do everything if he has rights to add/delete/change page.Page objects and is not given fine grained permissions. Now I wonder, why this is not working this way already...

On Tue, Dec 18, 2012 at 3:03 PM, Gwildor Sok notifications@github.comwrote:

Would that mean that all users will usually be able to do anything, unless they have a PagePermission set on them? That would be a good compromise, although it could be subject to security issues (for instance, when you create a new user and forget to set any PagePermissions on them, then they would be allowed to do everything they are allowed to by Django's auth). However, I think that is probably the best solution.

— Reply to this email directly or view it on GitHubhttps://github.com/bmihelac/feincms-feincmsext/issues/5#issuecomment-11486997.

Gwildor commented 11 years ago

Alright, sounds like a good solution to me :) This also makes things less confusing for admins who don't know a lot about how Django works.

bmihelac commented 11 years ago

this should be fixed, feel to reopen if you have any problems.

Gwildor commented 11 years ago

Thanks for your work. I just tested it quickly, and found that most things work as expected. However, one major thing doens't work: when an user has no permissions set on him yet, he still can't add any pages (it gives a 403 when trying to save the new page).

The following things do work as expected:

So, basicly, all that doesn't work yet is the saving of a new page in the root when an user has no permissions set to him.

bmihelac commented 11 years ago

Thanks for feedback.

I just pushed update, it should work now, can you check?

Gwildor commented 11 years ago

Thank you very much, it seems to work fine :)