Module Admin Restrict Branch

[Kiwi Chris]

I'm not sure whether it's an issue with the current version of the core (3.0.203), or some other interaction, but currently I'm getting a weird issue.

All users, regardless of what branch they're restricted to, are being restricted to the same branch. 

ie branch restriction is happening, but regardless of what branch is specified, they all get the same branch.

[edit] I seem to have found the source of the problem. It is an interaction between Multisite module and @kixe version ofAdminRestrictBranch.

What seems to be happening, is that when a user logs in, they will get the full page tree of whatever domain they have logged in under, regardless of how AdminRestrictBranch is configured.

In some ways that's desirable: log in under a domain, and only get that domain's page tree, but it's also a security issue, as if a user knows another domain in the same multisite setup, and logs in with the login that's supposedly restricted to the page tree for another domain, they can see the page tree of the other domain.

 

 

[adrian]

Is there a problem with my version of the module, or just kixe's? What features does that have that made you choose it - can I integrate them into mine?

[Kiwi Chris]

Oops! Sorry @adrian I just realised I got my module mentions back to front. I'm using your 'official' version of AdminRestrictBranch, and the Multisite version by @kixe

There does seem to be some interaction going on between them that's causing unexpected results. It's not necessarily a fault with AdminRestrictBranch, it looks like an issue with Multisite module as it hooks AdminRestrictBranch::getBranchRootParentId , but it's still worth mentioning here in case someone else runs into the same problem, so that they're aware of potential issues using the two modules together.

I found an easy fix was just to comment out the hook code in the Multisite Module.

[adrian]

Just an FYI that a couple of years ago I used Soma's multisite with ARB without any issues - in case that is at all useful.

Do let me know if there is anything I can do to allow that AdminRestrictBranch::getBranchRootParentId to not break things.

 

[Paul Greinke]

There have been no updates to this module for a long time.  Is it still good to use with 3.0.227 or are there better, more active alternatives?

[teppo]

"If it works, don't touch it" ?

Seriously speaking though, this module works well and does what it needs to do. So yes, if you want to restrict access by branch then it is a good option, regardless of which core version you are using.

[adrian]

Hi @Paul Greinke - as @teppo said, it still works as intended on the most recent PW versions and I use it in production so I should be aware of any issues that might arise in the future.

[Paul Greinke]

Great, than I'll keep using it. Thank you for your feedback!

[biniyam]

Hey.

I am a beginner in Processwire, can someone help please me with an issue:

Is there a way to restrict a role (e.g. 'sports-editor-role') to a page (e.g. 'sports-page') automatically via a PHP script? Only the superusers has access to Admin Restrict Branch, we have prepared a form for admins to assign roles to member users. 

[adrian]

@biniyam if you configure this module to the restriction you need you should be fine if your form assigns the required role to the users. It sounds like the "Role Specified Branch Parent" might be the best option based on your description - shouldn't need a php script.

[biniyam]

@adrian Thank you for your response.

I have configured it exactly as you mentioned above (i.e. configured the module to "Role Specified Branch Parent" option & the admins via the form assigns the required role to the users for existing roles created by superusers).

We have 'News' page and it's children are 'sports', 'politics', 'food' etc. and these children pages have corresponding roles as well. Whenever the admins add child pages to the 'News' page, a new role is created programmatically. For the existing roles('sports-editer', 'politics-editer', 'food-editer') the superuser has set branch restriction in the role setting manually. That means: if a user has a 'sports-editer' role, the user can only view/edit the 'sports' page. Now what we want is, for future creation of 'News' page children pages, we want to set the branch restriction via a PHP script. The reason being the client do not want the 'admins' to have access to Admin Restrict Branch Module, Access>Users, Access>Roles etc., there is a form prepared for such tasks for the admins.

I am just wondering if there is a way something like this: 

$role = new Role();
$role->name = 'sports-editor';
$role->admin_restrict_branch = $sportsPage->id;
$role->save();

Thank you.

[adrian]

$role->branch_parent is what you're looking for rather than admin_restrict_branch. But otherwise your example code should work.

[biniyam]

@adrian Thank you so much, this fixed the issue.