Page based permissions hierarchy

[Kiwi Chris]

I'd really like Processwire to have a robust page based permissions system rather than just template based out of the box.
If the page tree is compared to a file system, it would be nice to be able to set owner (user), group (role) and public permissions on a page and have this propagate to sub-pages unless explicitly over-ridden.

With a large site, it's quite possible to have multiple sections that use the same templates, but where editing needs to be assigned to different people, for different parts of a site.

I've seen some proofs of concept that have never been updated or maintained, so I'm sure it can be done, but this is a bit of a show-stopper for me with an otherwise excellent CMS.

I might be able to have a go at something myself, but since this is security related, and I haven't had a go at module development before, it would be really handy to have something robust that just works.

[kixe]

@Kiwi Chris Welcome! Could this module be a solution for you?
AdminRestrictBranch last update 12.04.2017, stable

[Kiwi Chris]

3 hours ago, kixe said:

@Kiwi Chris Welcome! Could this module be a solution for you?
AdminRestrictBranch last update 12.04.2017, stable

Thanks, I'll have another look at that module. Last time I tried, I didn't seem to be able to get it to work, but it looks as though it's been updated since.

If I'm reading the description correctly, it's not quite what I'm looking for although it's a step in the right direction.

Some editors might have responsibility for more than one branch of the tree, so restricting to just a single branch isn't ideal.
Rather than restricting a role to a specific branch, it would be more useful to assign a role(s) to a branch, so that a given role can have access to multiple branches if necessary.

[cstevensjr]

2 hours ago, Kiwi Chris said:

Thanks, I'll have another look at that module. Last time I tried, I didn't seem to be able to get it to work, but it looks as though it's been updated since.

If I'm reading the description correctly, it's not quite what I'm looking for although it's a step in the right direction.

Some editors might have responsibility for more than one branch of the tree, so restricting to just a single branch isn't ideal.
Rather than restricting a role to a specific branch, it would be more useful to assign a role(s) to a branch, so that a given role can have access to multiple branches if necessary.

If there are issues with a given module, you can always post your query/questions in the sub-forum for that module:

You can also report technical issues/possible bugs with modules directly at the particular  Project Page (Github) location:

https://github.com/adrianbj/AdminRestrictBranch

On the ProcessWIre Modules Page, for each module --- it lists the links to both the Forum Support and Project Page (Github):

http://modules.processwire.com/modules/admin-restrict-branch/

I would encourage everyone to use these essential resources to let the module authors know about bugs, possible changes or any other issues with their module.  Most module authors are willing to make changes to how things operate based on the comments or queries from module users.

[teppo]

13 hours ago, Kiwi Chris said:

I've seen some proofs of concept that have never been updated or maintained, so I'm sure it can be done, but this is a bit of a show-stopper for me with an otherwise excellent CMS.

I might be able to have a go at something myself, but since this is security related, and I haven't had a go at module development before, it would be really handy to have something robust that just works.

We've been using UserGroups for this use case for a few years now. This might be one of those unmaintained projects you were referring to, but if that's the case, it's mainly because it has been working just fine. No need to fix what isn't broken 

That being said, we haven't been using UserGroups with ProcessWire 3.x, so can't really say for sure how well those two work together.

[Kiwi Chris]

On 13/05/2017 at 4:42 AM, teppo said:

We've been using UserGroups for this use case for a few years now. This might be one of those unmaintained projects you were referring to, but if that's the case, it's mainly because it has been working just fine. No need to fix what isn't broken 

That being said, we haven't been using UserGroups with ProcessWire 3.x, so can't really say for sure how well those two work together.

Thanks. That looks like it's exactly what I need. I'll test it to see how it works with Processwire 3.x, but hopefully it will work fine.
It doesn't seem to be in the official modules directory, so that might be why I missed it.
I can use the Site Profile Exporter module to set up my own site profile with the module included.