Persmissions Usage

[Phil -- wbtc.fr --]

Hello guys,

here is a question which might be usefull for everybody who do theme customization: how does the permission's tab informations are used by In-Portal?
Do we need to use an  inp2:m_if check="x_HasPermission"  to use them? (where "x" is module name)?
Is there another way to retrieve permissions settings?
Is there any core embedded functions about them?

Phil.

[Alexander Obuhovich]

Is there another way to retrieve permissions settings?

To check any system unit permission tag "m_CheckPermission" should be specified in "check" parameter of "m_if" tag.

Do we need to use an  inp2:m_if check="x_HasPermission"  to use them? (where "x" is module name)?

"x" is unit prefix:

• l - for links
• n - for articles
• bb - for topics
• p - for products

Since one module can have more then one unit, then "x" is not a module name.

Is there any core embedded functions about them?

What this means?

--
Best Regards,

http://www.in-portal.com
http://www.alex-time.com

[Phil -- wbtc.fr --]

Thanks dor details.

By Core embedded function, I wanted to know if there is anything In-Portal do even if we don't use checking permission tag (like denying access to a page, a content...)

2010/10/5 Alexander Obuhovich <aik....@gmail.com>

[Alexander Obuhovich]

Yes, when user, who visits page doesn't have access to data displayed on the page, then he is redirected to "No Permission" page automatically. For example, when:

• someone guesses URL to pending link detail page;
• tries to edit link he haven't created by forging url;
• tries to view details of other user's order by placing it's ID on order history page.

This way In-Portal provides additional automatic data security layer, even, when theme developer doesn't know what he is doing by placing In-Portal tags in unusual places.

[Phil -- wbtc.fr --]

Let me add these options, found in default theme:

c_HasPermission > In-Portal categories permissions management?

HasPermission > Is there any rules to use without prefix?

2010/10/5 Alexander Obuhovich <aik....@gmail.com>

[Alexander Obuhovich]

Prefix is omitted, when used from DefineElement that is used from PrintList tag. That is general rule for all cases, when prefix could be omitted.

c_HasPermission > In-Portal categories permissions management?

yes.

[Phil -- wbtc.fr --]

I have an issue, using

 <inp2:m_if check="c_HasPermission" permissions="CATEGORY.VIEW"> 

it doesn't seems to work for index.tpl file.

I've included the above "category.view" permission in default design tpl, to benefit of permission system for the whole website. While other pages are displaying, the index page doesn't. I've checked permissions for "everybody","visitors", "logged users", but no luck here.

2010/10/5 Alexander Obuhovich <aik....@gmail.com>

[Alexander Obuhovich]

Does it work on http://www.your-web-site.com/index.html and http://www.your-web-site.com/ urls or only on one of them. In this case, which one.

[Phil -- wbtc.fr --]

I precise I use another theme, I have the theme in URL:

http://www.your-web-site.com/advanced/index.html > doesn't work (permission check not passed)
http://www.your-web-site.com/advanced/ > works (I see error page correctly, permission check passed)

2010/10/5 Alexander Obuhovich <aik....@gmail.com>

[Alexander Obuhovich]

I've tested and I can verify, that it doesn't work neither way.

Administrator can only set permission on "Content" category (usually it has ID #1 in database). But, when you visit index page you are in category with ID #0 (doesn't exist in database). So I propose to detect current category as ID of "Content" category instead of 0. This will solve it.

Side effect of such change will be to search for all places that actually are checking for current category to 0 to detect if we are on index page or not.

Here is a task for it: http://tracker.in-portal.org/view.php?id=880

[Alexander Obuhovich]

Here is the patch (also attached to the task). If works, then mark appropriate task as tested.

Suddenly found way how to make that change quick and without any dirty code changes, that I'll be regretting in later releases.

[Phil -- wbtc.fr --]

thanks for this quick fix !

I found a workaround, by putting index page code as default content in default design, it also make the work as we rarely want to obfuscate index page :)

2010/10/5 Alexander Obuhovich <aik....@gmail.com>