avoid inherit permissions

[Manfred62]

next problem I'm stucked on...

I have following structure:

- recommendations (template a)
-- january (template b)
--- menu 1 (template c)
--- menu 2 (template c)
--- menu 3 (template c)
-- february (template b)
--- menu .. (template c)
.....

every 'page' has its own template. Template b has no file! Now I restrict the access of templates for the role like this:

template a: view, edit (page template)

template b: view, new (should only act like a folder)

template c: view, edit, move

the problem is: 'template c' has no move. When I give b the move, then c also gets the move.

Is there a possibilty to solve this?

EDIT: played around with the settings. Seems, it's not possible. The 'move' config is only possible with the 'edit' checkbox. It depends on the 'edit' config. But also the 'move' checkbox is more or less senseless, because also if unchecked you have the 'move' box when 'edit' is activated.

Is this a bug?

thanks

Edited February 22, 2013 by Manfred62

[Manfred62]

small workaround in this case: I locked the pages (january - december) for editing. So it doesn't matter, if the user moves the (month)pages around. The names are fixed and non-editable. And with the use of the module 'ProcessPagePublish' the user can publish/unpublish the pages anyway.

But in general: this should be more exactly to fine tune. In the moment it's not possible to separate the functions.

You have to check 'edit' for the parent, to get the functions for the child.

Also if 'edit' is checked, you get automatically 'move', even when 'move' is unchecked.

I think, it's no good idea to let the user move pages around (and brake SEO or even worst ..the site).

Or did I oversee something? What are the exact conditions/constraints for this?

[Soma]

Its not possible to break inheritance of permissions unless you give a template of a child that has its own.

The behaviour you found with move and edit is right and has come up and was discussed already not long ago. When it comes to permissions it getting complicated and I not sure again why it is like this but remember its not something easy to change and depend how they work and are implemented. But I think Ryan as the creator of this could tell a little more and what his planes are regarding this particular problem.

[Manfred62]

ok, I found this thread from diogo. Thanks for info.

[ryan]

Keep in mind that the label "move" is referring to either "page-sort" or "page-move" permission, or both. So just because you see "move" doesn't meant that they can change the page's parent. It just means they can sort within the same parent. They can only change the parent if they have "page-move" permission, and the target location accepts pages of that template (via family settings). So if you are seeing "move" when you don't think you should, test it out. You may find it's actually doing what you want. 

With regards to why "page-sort" permission refers children of a page rather than a page itself, there's a very good reason. If it didn't behave that way, then you could affect the sort order of pages you didn't have permission to. This is because the sort order of one page affects the sort order of sibling pages. You could feasibly have access to sort some pages and not others, within the same parent. That would be a security problem. So the only secure way for a "sort" permission to be assigned is as a permission of the parent.