Module Admin Restrict Branch

[adrian]

Thanks @tpr - I did think about the breadcrumbs issue, but wasn't actually sure if it should be modified or not - perhaps it is actually useful for editors to know where their branch fits in the site (even though they don't have access to the rest of it). Perhaps this could be an optional change?

I am curious about your comment about setting up the roles and permissions being a huge amount of work - do you feel like it was extra work because of this module, or juts because of the way PW roles and permissions work? In my experience with this module so far, it actually reduces the complexity of the setup, because I can actually all roles full editing privileges inherited down from the "home" template, knowing that they can't actually mess with any pages that aren't in their restricted branch, but I can see situations where you still might want restrict what they can do within templates within the branch, but for that I am finding the new " Additional edit permissions and overrides" setting in the template access tab incredibly useful.

[tpr]

In my project users should not see the extra breadcrumbs, though it's not a problem if they do. So I can live with it as it is

[tpr]

I guess you're aware of that inserting links using the autocomplete field in the CKEditor lists pages outside the restricted branch. Is there anything that can be done here? For me it's OK to only hide the autocomplete field for now.

[adrian]

I guess you're aware of that inserting links using the autocomplete field in the CKEditor lists pages outside the restricted branch. Is there anything that can be done here? For me it's OK to only hide the autocomplete field for now.

Actually I hadn't noticed that - thanks for pointing it out.

Sorry it's taken so long to get to, but the latest version of the module now has a new config setting to optionally exclude pages outside the restricted branch from the search results of pages. 

Please test and let me know if you find any problems.

[tpr]

This is great, thanks!

Also seems to honor "Branch edit exclusions" so it's even better.

Just a side note: my current setup has identical page names so a few pages come up twice, but that's because of my custom path hook. However, this is only a cosmetic issue as those paths are the same, selecting any of those is OK.

[Christophe]

Hello Adrian,

Sorry to bother you.

References :

https://processwire.com/talk/topic/2074-module-page-edit-field-permission/?p=110862

https://processwire.com/talk/topic/2074-module-page-edit-field-permission/?p=111223

All of a sudden, almost everything seems restricted for this user.

"How to match user to branch" is set to "Specified Branch Parent".

"Branch parent to restrict access to" is (still) set to nothing for this user.

(Could it be that an old test setting has reappeared?)

Perhaps I should reinstall it and see what happens.

Edit: I've rapidly uninstalled it and then reinstalled it (without removing the folder via ftp).

I've set it to "Specified Branch Parent".

I've only restricted the access (to the "Membres" section of the tree) for 3 users (with the "membres" role).

But the user (with the simpleuser role) that I haven't restricted to anything is restricted to almost everything now. It wasn't the case before.

[adrianmak]

does it support multiple branches ?

[Christophe]

Hello,

Do you mean the number of branches that are restricted?

There was only one.

I've just restricted the user (who has/had the issue) to the homepage and now it works.

Edit: perhaps it is what should always be done if the user doesn't have the superuser role...(?)

But I wonder why this happened, as, if I remember well, I had not changed anything for this user before I noticed this problem.

(I'm a little bit "worried" something like that could reappear. But now it shouldn't.)

[adrian]

@Christophe - sorry you are having trouble - I am curious about "all of a sudden" - I feel like something must have changed. I did add some new functionality yesterday, but this shouldn't be an issue - what version of the module are you running?

Did you update PW or anything else between when it was working as expected and now?

But the user (with the simpleuser role) that I haven't restricted to anything is restricted to almost everything now.

I don't really understand this - "restricted to everything" - does that mean the user is restricted from access to everything or that they can see everything when they shouldn't?

I see in one of the threads you linked to that you are also using code in your ready.php - is the problem still there if you remove that code?

does it support multiple branches ?

@adrianmak - no it doesn't support multiple branches - it would have to be re-written completely for that and there are some core PW issues that would currently prevent this from working perfectly. It is also not really the goal of this module - it was designed for sites that have user specific parent branches - it is not really for hiding or restricting to a variety of sections. You might look at: https://processwire.com/talk/topic/1176-hiding-uneditable-pages-from-users/?p=84916 as a usable but not ideal solution.

Hello,

Do you mean the number of branches that are restricted?

There was only one.

Now, I have restricted the user (who has/had the issue) to the homepage and now it works.

But I wonder why this happened, as, if I remember well, I had not changed anything for this user before I noticed this problem.

I'm a little bit "worried" something like that could reappear.

I still don't fully understand what is going on - does restricting to the homepage mean they now have access to everything, but before they weren't getting access to anything?

I wonder if maybe there are some config setting being left in the system that are conflicting? Can you post the contents of the data field for module's settings - you'll need to get this via PHPMyAdmin or similar - modules table - grab the entry for this module - maybe there will be a clue in there?

[Christophe]

Hello,

Version 0.1.9. Now 0.2.0.

I don't remember updating something.

I've done what is here: https://processwire.com/talk/topic/2074-module-page-edit-field-permission/?p=110990

ready.php doesn't seem to change anything now.

"Restricting to the homepage means they now have access to everything, but before they weren't getting access to anything" -> Yes (it's just one user account involved). It was only getting access to this:

https://processwire.com/talk/topic/2074-module-page-edit-field-permission/?p=111223 (first two images attached).

Coming back with "the contents of the data field for module's settings".

Is this what you want?:

{"matchType":"specified_parent","branchesParent":null,"phpCode":"","restrictType":"editing_and_view","branchExclusions":[]}

Going to bed (it's very late/early). Perhaps going to eat before .

[adrian]

Thanks for those settings - everything looks normal for using the "specified_parent" option. 

I wonder if the "Branch parent to restrict access to" setting on the user's setting page was set to something unexpected before you changed it to "home". Can you try resetting it to the desired branch to see if the problem returns?

If it does return I wonder if you'd consider giving me access to the PW so I could investigate if there is some strange conflict?

[Christophe]

I'm sending you a PM.

[adrian]

Just wanted to wrap this up and let folks know that the problem that @Christophe discovered has been fixed.

[adrian]

Just popped in to say that the module works pretty well. I've set up roles and permissions (which was a huge work), and I could achieve a state where everything is working as it should on the site.

The only glitch I see is that when editing a page (with a restricted branch user), the breadcrumb on the top shows items above the restricted branch too:

Home -> Page1 ->  Page2 (ARB top level) -> Page3 (-> Page4 under edit)

"Home" and "Page1" should not be visible as they are above the restricted branch. Fortunately clicking on them goes to the restricted branch top, so no harm is made. On the top level the breadcrumb is OK.

@tpr - I have just added an option to modify the breadcrumbs to remove pages that are outside the restricted branch. It seems to be working well here, but please let me know if you notice any problems.

It's a new config setting option that needs to be checked.

This example is for a user restricted to "Branch One"

Modified Breadcrumb:

Full / Unmodified Breadcrumb:

[planmacher]

Hello,

I can't get this module to work - perhaps you can help me.

I have a very simple page tree:

All of the first level pages (under "home" ) have the same template. So it is not possible to restrict a branch via user roles. But AdminRestrictBranch sholud do this... - but how?

 

Lets say I woluld like to restrict the user "test" to the branch "projekte".

So in the module under "how to match user t branch" I choose "Role Name:

 

Then I add a new role "projekte":

Which boxes do I need to check there?

Then I add this role to the user "test:

 

What do I have to set in the template options?

 

Are there other permissions the user should get in oder to get this module to work?

Whatever I tried - the result is: The users have same permissions to all the first level pages in the tree. 

 

Would be great if you can give me some help ...!

 

[adrian]

Hi @planmacher - it looks to me like your setup should work. The one obvious thing to check is that the "name" of the Projekte page is actually "projekte" - I assume it is, but it might be different. Can you confirm that first before we investigate further?

EDIT: I just realized - you also need to make sure that projekte role has edit permissions on the home template that inherit down, or on the template of the Projekte page.

[planmacher]

Hello and thanks for reply!

So again...

Module

User:

Hometemplate:

And the name of the "projekte" page is really "projekte".

Tried it even with another role and template name. Always the same: The permissions to the user are the same for all the pages.

Anny ideas??

[adrian]

Is your site available on the web somewhere, or just on your local dev setup? If you'd be willing to PM login details, I'd be happy to take a look.

[planmacher]

Very appreciated!

Sent you  PM ...

I am very new to PW - so perhaps I am thinking/doing something wrong very basicly.

Thanks!

[adrian]

Just wanted to post here to note that the issue @planmacher had has been fixed - it was actually affecting the role name and custom php code options.

[SteveB]

FYI, just tried this in 3.0.10 using PHP to say what the branch is:

return ($user->hasRole('editor')) ? '/data/' : '';

   Edit: I see it wants a name, not a path. Made that change but no difference, still repeats.

The odd thing is that the page tree now shows up like this (note repetition):

Data

  Alpha

  Bravo

  Charlie

  Alpha

  Bravo

  Charlie

[adrian]

Hi @SteveB, I just tested using that approach (with "data" instead of "/data/") and it looks to be working just fine here.

You have me thinking though that maybe the custom PHP code approach should be path, not name. I'll need to think about this more. 

In the meantime, is there any chance I can get access to this PW install to see if I can figure out why you are getting that repetition? I am sure it won't be hard to fix once I know why.

[adrian]

Still waiting  to hear from you @SteveB!

But in the meantime I thought a little more about name vs path matching and I have made some additions in this area.

You can now either return a name or a path in the custom PHP code option. Path is the recommended option. This change doesn't affect the other two matching modes, but it should make this mode more efficient.

[SteveB]

Sorry about the delay. If I pick a different branch I don't get repetition.

Thought maybe it's some conflict with something I've done but the only thing I'm doing with permissions is in a modified ProcessPageAdd where I changed ___executeNavJSON() and ___execute() so I can allow certain roles to add pages in certain places. It can override allowed parent and allowed template for a page add request but that's the extent of it.

What would make whatever builds the Page tree cycle through twice?

Edit...

Further tests:

Works fine if I specify the name of a child of the branch that repeats.

Tested without my modified ProcessPageAdd and it made no difference.

[adrian]

Sorry about the delay. If I pick a different branch I don't get repetition.

Thought maybe it's some conflict with something I've done but the only thing I'm doing with permissions is in a modified ProcessPageAdd where I changed ___executeNavJSON() and ___execute() so I can allow certain roles to add pages in certain places. It can override allowed parent and allowed template for a page add request but that's the extent of it.

What would make whatever builds the Page tree cycle through twice?

It would be a good start to temporarily revert to the default core version of ProcessPageAdd to see if that fixes the repetition. 

This module does hook into Page:addable() and Page::editable() to prevent editing and adding to pages outside the restricted branch. We're getting off topic, but perhaps you should use those hooks rather than editing the core ProcessPageAdd - at least I think you should be able to achieve what you want with those hooks - btw, these are not listed in Captain Hook which is why you may not know about them.