Jump to content

Admin Restrict Branch


adrian

Recommended Posts

I'm not sure whether it's an issue with the current version of the core (3.0.203), or some other interaction, but currently I'm getting a weird issue.

All users, regardless of what branch they're restricted to, are being restricted to the same branch. 

ie branch restriction is happening, but regardless of what branch is specified, they all get the same branch.

[edit] I seem to have found the source of the problem. It is an interaction between Multisite module and @kixe version ofAdminRestrictBranch.

What seems to be happening, is that when a user logs in, they will get the full page tree of whatever domain they have logged in under, regardless of how AdminRestrictBranch is configured.

In some ways that's desirable: log in under a domain, and only get that domain's page tree, but it's also a security issue, as if a user knows another domain in the same multisite setup, and logs in with the login that's supposedly restricted to the page tree for another domain, they can see the page tree of the other domain.

 

 

Link to comment
Share on other sites

Oops! Sorry @adrian I just realised I got my module mentions back to front. I'm using your 'official' version of AdminRestrictBranch, and the Multisite version by @kixe

There does seem to be some interaction going on between them that's causing unexpected results. It's not necessarily a fault with AdminRestrictBranch, it looks like an issue with Multisite module as it hooks AdminRestrictBranch::getBranchRootParentId , but it's still worth mentioning here in case someone else runs into the same problem, so that they're aware of potential issues using the two modules together.

I found an easy fix was just to comment out the hook code in the Multisite Module.

Link to comment
Share on other sites

Just an FYI that a couple of years ago I used Soma's multisite with ARB without any issues - in case that is at all useful.

Do let me know if there is anything I can do to allow that AdminRestrictBranch::getBranchRootParentId to not break things.

 

Link to comment
Share on other sites

  • 1 year later...

"If it works, don't touch it" ?

Seriously speaking though, this module works well and does what it needs to do. So yes, if you want to restrict access by branch then it is a good option, regardless of which core version you are using.

  • Like 4
Link to comment
Share on other sites

  • 11 months later...

Hey.

I am a beginner in Processwire, can someone help please me with an issue:

Is there a way to restrict a role (e.g. 'sports-editor-role') to a page (e.g. 'sports-page') automatically via a PHP script? Only the superusers has access to Admin Restrict Branch, we have prepared a form for admins to assign roles to member users. 

Link to comment
Share on other sites

@biniyam if you configure this module to the restriction you need you should be fine if your form assigns the required role to the users. It sounds like the "Role Specified Branch Parent" might be the best option based on your description - shouldn't need a php script.

Link to comment
Share on other sites

@adrian Thank you for your response.

I have configured it exactly as you mentioned above (i.e. configured the module to "Role Specified Branch Parent" option & the admins via the form assigns the required role to the users for existing roles created by superusers).

We have 'News' page and it's children are 'sports', 'politics', 'food' etc. and these children pages have corresponding roles as well. Whenever the admins add child pages to the 'News' page, a new role is created programmatically. For the existing roles('sports-editer', 'politics-editer', 'food-editer') the superuser has set branch restriction in the role setting manually. That means: if a user has a 'sports-editer' role, the user can only view/edit the 'sports' page. Now what we want is, for future creation of 'News' page children pages, we want to set the branch restriction via a PHP script. The reason being the client do not want the 'admins' to have access to Admin Restrict Branch Module, Access>Users, Access>Roles etc., there is a form prepared for such tasks for the admins.

I am just wondering if there is a way something like this: 

$role = new Role();
$role->name = 'sports-editor';
$role->admin_restrict_branch = $sportsPage->id;
$role->save();
Thank you.
Link to comment
Share on other sites

  • 2 months later...

Many thanks from me too for the wonderful module,  @adrian!

Is there a way to display another navigation point in addition to "pages"?
I created a module that outputs statistics about the page in the backend. I would like to have this as an additional access point for users.

Link to comment
Share on other sites

  • 3 months later...

Hey @adrian I had a look into your modules code to see how you restrict search results in the PW backend. I need this for a multisite module I'm building. I took your hook:

wire()->addHookAfter('ProcessPageSearch::executeFor', $this, 'hookSearchResults');

...but wondered why it did not trigger my callback. First I thought the bd() call in the callback might not be working, but turned out the callback was never triggered. So I added a hook recorder and got a log like this:

ProcessWire\FieldtypeModule::formatValue
ProcessWire\FieldtypeModule::formatValue
ProcessWire\ProcessController::execute
ProcessWire\FieldsArray::changed
ProcessWire\FieldsArray::changed
ProcessWire\FieldsArray::changed
---
ProcessWire\ProcessPageSearchLive::execute
ProcessWire\ProcessPageSearchLive::getDefaultPageSearchFields
---
ProcessWire\FieldtypeModule::formatValue
ProcessWire\Pages::find
ProcessWire\PageFinder::find
ProcessWire\PageFinder::getQuery

Which made me aware of "ProcessPageSearchLive". I then changed my hook to hook into ProcessPageSearchLive and boom, everything worked as expected.

Now I'm wondering why your module only hooks into ProcessPageSearch. Does that even work? Or am I missing something?

Thx!

Link to comment
Share on other sites

Hey @bernhard - I don't think I want the ProcessPageSearchLive in my case because I want any user to be able to find view links publicly available pages, but because the module makes these restricted pages uneditable for the user, the edit links for restricted pages aren't returned via the live search anyway.

As noted in my source code, ProcessPageSearch::executeFor is for things like pages returned from autocomplete when inserting a link to a page in a CKEditor field.

So, I think I am covered, but please do let me know if I have misunderstood or overlooked something.

  • Thanks 1
Link to comment
Share on other sites

Thx @adrian that already helps!

12 hours ago, adrian said:

As noted in my source code, ProcessPageSearch::executeFor is for things like pages returned from autocomplete when inserting a link to a page in a CKEditor field.

I missed that comment!

12 hours ago, adrian said:

because the module makes these restricted pages uneditable for the user, the edit links for restricted pages aren't returned via the live search anyway

This one is interesting. This is not the case for me! I'm also hooking Page::editable and Page::addable and the live search returns non-editable pages as well...

Link to comment
Share on other sites

4 hours ago, bernhard said:

This one is interesting. This is not the case for me! I'm also hooking Page::editable and Page::addable and the live search returns non-editable pages as well...

Does it return them with links to edit those pages, or just view them? For me it returns the view link which is fine.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...