Document Access Permissions

From MODx Wiki

Contents 1 Access Permissions 2 Creating a document group 3 Document Permission Rules 4 Examples

Access Permissions

When creating or editing a document in MODx, if you scroll down to the bottom of the page in the MODx Manager, you should see a section titled: Access Permissions.

The default option is: 'All Document Groups (Public)' - there will be other options if you have created new document groups.

To set access permissions:

1. Create a new document.
2. Assign this document to a group or groups. NOTE: If you assign this document to the PUBLIC document group, it is accessible on both the frontend and the backend by all users. Also if you select the PUBLIC option, you cannot select additional groups.
3. If you do not assign any web users to this document group, this makes it public in frontend.
4. If you assign this document group to a managers group, then only that managers group can edit it.

You can assign any document to any group. Access restrictions only apply in the following situations:

• FRONTEND: Assign web users to this document group. Do not assign any web users to this document group to make it PUBLIC.
• BACKEND: Assign manager users to this document group.

Creating a document group

From the MODx Manager page:

1. Select the Security Tab.
2. Select the Web Permissions Link.
3. You should see 3 tabs now: Web User Groups, Document Groups, and User/Document Group Links. Select the Document Groups Tab.
4. Type the name of the new Document Group into the input box and click the Submit Button.
5. Select the Managers Permissions Link.
6. Same as number 3 above.
7. Same as number 4 above.

You have now created a new document group that exists in both the FRONTEND (Web Users) and the BACKEND (Managers). Once you have created the document groups, they will appear listed at the bottom of the document editing screen in the MODx Manager for each document. To assign the document to a document group, just edit the document, check the checkbox for that group, and save the document.

You can see a master list of which documents are assigned to which groups by selecting: Security | Web Permissions (or Manager Permissions) | Document groups. You can also manage document groups for multiple documents at the same time by selecting: Modules | Doc manager | Document Permissions.

Document Permission Rules

1. Any document that is not assigned to a document group is open for everyone.
2. A document in a document group that is not connected to a user group is open for everyone.
3. As soon as a document is assigned to a document group that is connected to a user group, it can only be accessed by users belonging to that user group.
4. The above rules apply to both Manager User permissions and Web User permissions, BUT:
5. Manager User permissions (which apply in the Manager) and Web User permissions (which apply in the front-end) are entirely separate.
6. Setting Manager User permissions has no effect on Web users and vice versa.
7. The same document group can be connected to either or both, however.

Examples

Imagine This document and user groups scenario:

• Manager Users Groups
  • MugEditors
    • Darlene
    • Alfalfa
  • MugReviewers
    • Spanky
    • Buckwheat

• Web Users Groups
  • WugFans
    • Happy
    • Grumpy
  • WugNewbies
    • Doc
    • Sleepy
  • WugNobody
    • (no members)

• Document Groups
  • NewsBriefs -- assigned to no user group
  • Reviews -- assigned to MugReviewers, WugFans
  • Events -- assigned to MugEditors, WugFans
  • Gossip -- assigned to MugEditors, MugReviewers
  • FanOnly -- assigned to MugEditors, WugFans
  • Ed-Private -- assigned to MugEditors, WugNobody
  • Rev-Private -- assigned to MugReviewers, WugNobody
  • ManagerOnly -- assigned to WugNobody
  • NewbieOnly -- assigned to WugNewbies

• Documents
  • Doc1 -- assigned to no document group (accessible to: anyone)
  • Doc2 -- assigned to NewsBriefs (accessible to: anyone -- not assigned to a doc. group)
  • Doc3 -- assigned to Reviews (accessible to: Spanky, Buckwheat, Happy, Grumpy)
  • Doc4 -- assigned to Events (accessible to: Darlene, Alfalfa, Happy, Grumpy)
  • Doc5 -- assigned to Gossip (accessible to: Spanky, Buckwheat, Happy, Grumpy, all front-end users)
  • Doc6 -- assigned to FanOnly (accessible to: Darlene, Alfalfa, Happy Grumpy)
  • Doc7 -- assigned to Ed-Private (accessible to: Darlene, Alfalfa)
  • Doc8 -- assigned to Rev-Private (accessible to: Spanky, Buckwheat)
  • Doc9 -- assigned to Ed-Private, Rev-Private (accessible to: Darlene, Alfalfa, Spanky, Buckwheat)
  • Doc10 -- assigned to ManagerOnly (accessible to: all Manager Users, no front-end users)
  • Doc11 -- assigned to NewbieOnly (accessible to: all Manager Users, plus Doc and Sleepy)

Note that in this setup, the Manager Users would not see many of the documents in the front-end when not logged into the Manager unless added to the appropriate Web User groups.