modmore / ClientConfig

ClientConfig is a MODX Revolution Extra to allow clients to maintain settings in a user friendly way.
https://docs.modmore.com/en/Open_Source/ClientConfig/index.html
MIT License
28 stars 27 forks source link

Permissions Error when trying to switch contexts. Can the dropdown be hidden per user group? #138

Open pmacswebteam opened 6 years ago

pmacswebteam commented 6 years ago

Summary

When logging in as a publisher who only has access to a specific context, the "Choose Context" dropdown remains visible, but throws an error when trying to use it (see screenshot) screen shot 2017-10-19 at 10 48 58 am

Also noticed, when logged in as a member of this same Publisher Group, my updates to the configurations are not being reflected.

Step to reproduce

  1. Login as publisher
  2. Go to Extras > Configuration
  3. Click the "Choose Context" dropdown

Observed behavior

See screenshot above.

Expected behavior

The error makes sense, since the user does not have permission to access other contexts, but can this option be hidden from specific user groups/users altogether, so that they can never click on the dropdown and see the error?

Environment

ClientConfig 2.0.0, MODX 2.5.7, macOS Sierra

sebastian-marinescu commented 6 years ago

Sounds reasonable. So either the user should only be able to switch through contexts he has permissions for, or either if it's a restricted user, then don't show the dropdown altogether – are these considerable solutions?

Mark-H commented 6 years ago

Hm, I would expect in this case the context selector to still work, and be shown, but to only show the one context they have access to.

Can you check if your user has view_context permission?

sebastian-marinescu commented 5 years ago

Just stumbled upon something maybe related, wanted to note it here:

For correct context-access (listing) the user-group needs a "AdministratorTemplate" with view_context here. I thought a "ContextTemplate"-access-policy with view there should be efficient, but it's not.