Access control: Disable admin Lister (search)? Or don't show any pages except some templates?

[donatas]

Hello.

I have a role that I want to limit only to see very few specific pages/templates, but I have like 50 templates (and more might be added with time). They are well access managed so this role can't edit any pages with them, but can see them in the system (guest role view permission).

I have forcefully hidden the page tree and switched it with a Dashboard module for more control and redirect users after save, etc to it. But if a user goes to Pages > Find - he can see anything he wants... That I don't want (emails in "created by", Order numbers, etc). I can't completely remove view permission from some templates, as they are parents to pages I want to give access to this role. And some things don't work if I completely remove view permission.

I use "page-edit-created" and "page-publish" permissions to limit editing capabilities. I am using Lister Pro module with access control to show only very specific things to user.

Maybe there's a way to force disable showing most pages? Or the Lister all together? Use custom permission to disable it with a hook?

Maybe create a custom permission, like "page-view-created" to allow viewing only your own created pages or something similar? And then using hook to decide whether to render a page in any list or not?

Are there any possible options? Any suggestions? Security is key here.

Thank you for any insight!

[kixe]

I can provide a module for this usecase:

https://github.com/kixe/AdminHidePageTreeByRole

... or try one of them:

https://processwire.com/modules/admin-restrict-page-tree/
https://processwire.com/modules/admin-restrict-branch/

[Robin S]

10 hours ago, donatas said:

Or the Lister all together?

Create a new permission named "page-lister-lister" to signal that you want to have access control over the Find lister. Then you can give that permission to any roles that you want to be able to access the Find lister, and other roles won't be able to access it.

[roderigo]

May Lister be good for rapido online restaurant e-menu development ? We need option for user to see menu items with photo , description , price and to select many item they wish to order. Maryla can take order over phone and customer love services but some time we better should like user to check out online so it sends message direct to kitchen while Jeffry prepare queso frijoles, especial daily, chorizo fermentado, el stanko salchichón, meat boat, and other customer favorite. Most customer take out since covidiarrhea real concern here so we wish to improve our e-portal online menu. Greetings from home of Roderigo Kitchen, best wishes and thanking you.

[donatas]

Thank you @kixe! One of the modules you listed (AdminRestrictBranch) was cutting it very close, however it can't do multiple branches unfortunately. Still managed to reach my goal with it and some additional hooks into PageLister and PageSearch to limit the selectors used for them. Thank you for help!