concept of permissions

[Spica]

As I am quite new to PW I do not fully understand the permission concept. So I put just some Questions.

1. How does page-edit-created permission work. Is it ment to give only creators edit permission to ther own pages? And how is it drawn to a role or template?

2. How to withdraw pagebased the edit permission for users/creators, reflecting the page-edit-created permission?

3. How do I customize rolebased the access to e.g the settings tab in page edit mode?

4. Is there a way do differentiate page-edit and page-publish permission?

[ryan]

1. How does page-edit-created permission work. Is it ment to give only creators edit permission to ther own pages? And how is it drawn to a role or template?

page-edit-created is an optional permission that you can choose to create yourself in Access > Permissions. You would use this permission if you wanted a user to only be able to edit specific pages that they had created, or that you assigned to them.* 

For instance, lets say you had a blog with multiple contributors. All the blog posts use the same blog-post template. Then lets say you had a role named contributor. That role has page-edit permission. Your blog-post template (Setup > templates > blog-post > Access) has that contributor role assigned for "can edit pages" and "can create pages". The template used by the parent of the blog /posts/ (template blog-posts) would have "can add pages" assigned as the only permission on the access tab. 

If you've got the setup above, then users with the contributor role can edit any of the blog-post pages. But if you then add page-edit-created permission to the contributor role, suddenly those users can only edit blog-post pages that they created (or that you assigned them as the created user*). They can't edit blog post pages that other users created. 

To take the example one step further, add another new permission called page-publish (in Access > Permissions), but don't assign it to the contributor role. Now those contributor users can create blog-post pages, but not publish them. At this point, you've got a nice workflow setup where you as the administrator (or someone else you assign) has to approve those blog posts before they are published. 

*To adjust the "created user" on specific pages, see the setting under Setup > Templates > [your-template] > Advanced > Template Toggles > Allow created user to be changed on pages? Once that box is checked, you can change the "created user" on any page from the Settings tab. 

2. How to withdraw pagebased the edit permission for users/creators, reflecting the page-edit-created permission?

3. How do I customize rolebased the access to e.g the settings tab in page edit mode?

 

Not positive I understand the questions, but if i did then what I wrote above answers these as well. 

 

4. Is there a way do differentiate page-edit and page-publish permission?

 

They are different permissions that do different things, so there's isn't crossover. But page-publish requires page-edit, so page-publish does nothing without a user first having page-edit on the same role. If your system has a page-publish permission, and a user doesn't have it in their role(s), then they can only edit unpublished pages (or create them if you assigned that ability somewhere). 

[Spica]

Thank you Ryan for your answere. I already played a bit with the roles and permissions, it was hard to find out how its ment to be. But I still wonder, if the page-edit-created isnt a global permission for all users but superusers instead only for assigned. I found line 135 in pagepermissions.module and did already another post on that.