1

I have an application being developed that will need some complex member permissions. There is one channel that has an ownership field with a text value that represent a particular department. There will be several hundred users in this system, and most of them should only be allowed to add and edit channel entries that belong to their department.

Adding a simple custom member field is a quick solution, but the problem is that their will be multiple users who need multi-department access (but not full access to all records) as well as some admins who can see all. The template conditionals and all that are easy enough, but this renders using custom member fields useless, and having 3-400 hundred member groups and juggling their permissions means hundreds of conditionals and growing as the member groups grow...

I know their is Zoo Visitor, but I don't know if that has the functionality I'm looking for. Basically I'd think I'd like something along the lines of "permissions tags" for members. Does anyone have this type of user-role control implemented and can suggest something? I've actually only been at EE for as long as I've been a member here (6-8 months), and haven't deployed a lot of popular addons. Thanks.

  • I've come across the question but never found a good solution myself jchrono-battle, for me I'm sure you'd be able to set up Zoo Visitor checkboxes for the permission setting, but the extension that hooks into the CP and controls the available publish options would be quite complex wouldn't it... Care to have a chat about it?? chat.stackexchange.com/rooms/23537/… – Blatant May 7 '15 at 14:16
  • I'll join the chat! – jrothafer May 7 '15 at 14:20
1

JChrono and I had a nice discussion on this (chat link might still work in comments above), I've taken the opportunity to write up our chat, findings and proposed solution.

Firstly, we discussed the requirement to set the access permissions against a user. There are many many (lets say X number of) departments and each department has its own channel. We discovered that we will need a "member management" role that would grant other members access / posting permissions in the channels they manage. members can be assigned to more than one department, and there will be in excess of 1000 members.

After some discussion we concured that as member fields lack any sort of value|label options that suit, we could leverage Zoo Visitor. Zoo Visitor essentually creates a members channel, with an entry for each user and also links all this up in the CP. With this we also leverage the power of any EE field, and as such a group of checkboxes with values and labels. So now we can save a members access priviledges easily and they are easier for the moderator group to manage.

The next step discussed was applying these permissions. Here some discussion of what areas we are protecting saved us quite a lot of time. We quickly identified we will need to code an extension to hook into various publishing events in order to apply proper server side control.

We determined that the Admin CP was out of scope for this project, this itself saved ALOT of hook planning (see Control Panel Hooks). For both members and moderators all entry posting would be don via the Channel Entry Form (Saef) on the front end. Moderators will have CP access ONLY to manage members, and will have no access to the Publishing options in the CP.

With this knowledge we discussed the implimentation of the SAEF form. We can query the member object before displaying the form, this will tell us what channels or departments the user can post too, populate the channel selector (if applicable) and also hide the form if the user has no posting priviledges.

Lastly we discussed creating an exteension that hooks the entry_submission_start event. Here we can re-run the 'has access' logic just in case someone was trying to force a POST to a different channel.

There you have it, having the CP out of scope gave us a much more consise definition of what was needed, We covered how to set permissions safely (Use the CP to stop any injection of priviledge), we covered how to present the publish/edit form allowing membes only the posting options they need and finally we covered how to safeguard the posted SAEF form, in case someone was trying the good old post injection.

I certainly look forward to hearing how JChrono gets on and I'm sure he'll let us know!

Quote of the chat :

it's like pulling teeth from an already buried horse...

:D

| improve this answer | |
  • It was a success! Thanks again for your help. – jrothafer May 7 '15 at 18:19
0

It sounds to me that you need something like hooblong to manage access control, preferably with hookan to manage permissions. See general descriptions

Even with these modules, managing fine-grained permissions can be complex, and these modules provide a number of different approaches, depending on your exact needs. I am happy to help you get up to speed - the modules come with online support to get you started.

Having just finished upgrading hooblong to version 2, the manual is not quite fully up to date and the access logic also needs some more updates - still they cover most of what you need to get started. Download these documents from the documents menu at debeer.com

More info on dealing with large numbers of groups/members combinations

| improve this answer | |
  • Thanks for the suggestion, John. I'll check it out, but because of the single channel for all departments, I can't really use member group permission to control things, the permissions come down to a per-entry control. – jrothafer May 7 '15 at 18:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.