So, I encountered the task to add another user to the Concrete5 excellent CMS and give only restrictive rights to him.
The process was not that straightforward unfortunately but still, in the end it did a good job.
The main problem is that propagating the rights to the pages below the one you're setting the permissions to, it is at least cumbersome. I mean, the system works probably well in propagating the assigned rights to the newly created pages under the one you set the rights for. However, the behaviour for the existing pages seems to be unfortunately... undetermined.
I have a site using 2 languages so I have two branches under the Home page, one being En (for English).
My intent was to make only the files under the "En" branch editable by a certain user (that belongs to the En_Editors group).
I followed these steps:
- create En_Editors group.
- create editor1 user and assign him to En_Editors.
- add "define('PERMISSIONS_MODEL', 'advanced');" to config/site.php to enable advanced permissions.
- in full sitemap click on the "En" page and choose "set permissions"
- make it "set: manually", add the En_Editors group to the table and check the desired permissions for it.
- Verify that you have the "Sub-pages added beneath this page:" set to "Inherit the permissions on this page" then Save.
Until here everything as expected.
However, verifying the permissions of random pages in the hierarchy under the "En" page, I have noticed that permissions vary according to 3 cases:
- Certain files had permissions inherited from the "En" page - OK! This is what I expected.
- Certain files had permissions set on "manually", and different than what I set at the hierarchy top - not OK. (It could be the fact I tried to set those pages' permissions individually before activating the advanced permissions. Still, not OK, because I expected they should've been overwritten, i.e. inherited from the parent)
- Certain files had permissions inherited but from the "Home" page instead of "En" - not OK!
For those set with "Home" as parent page (case 3 above), as the page it is inheriting from cannot be chosen (why?!), I had to set it first to "manually", then save, then in one more step set again to "by Area of Site (hierarchy)".
After this operation the "This page inherits its permissions from:" took the right value "En" instead of "Home".
Luckily, I have noticed that even if it says "This page inherits its permissions from: Home", if I simply click Save it actually sets it right, to the "En" page, so it kinds of overwrite/recomputes the parent value if just saved again! Few clicks saved.
But all in all too many clicks... I had to check and modify accordingly each and every file in the hierarchy.