admin wrote:
It seems that few users still have ACL problems, but I cannot reproduce any bug at this level
For me all is working fine at this level.
Hi Admin,
I found a small issue in the ACLs - perhaps this may be similar to what others are experiencing
If the users view access level is lower than saved records view access level
AND the users that have view own / edit own / delete own permissions
One might argue that if the record has a higher access level than a lower level user they should not be able to view / edit / delete but should the view own / edit own / delete own permissions override if they are set to allow?
(Tested on Joomla 2.5 build)
Registered User is given the following ACL permissions
Configure - Not Allowed
Access Admin Interface - Not Allowed
Create - Not Allowed
Delete - Not Allowed
Edit - Not Allowed
Edit State - Allowed
View own - Allowed
Edit own - Allowed
Delete own - Allowed
Case Study
lets say the registered user is an employee and he /she posts a private message to their manager
the employee can publish, archive, delete and edit their own posts
the manager can see all posts from employees
other employees can only see their own posts
The Current ACLs prevent the Author from seeing / editing their own records If the record access level is higher than the users view access level
By Definition of the ACL configuration above this user should be able to view, edit, delete, and change state (published, archived, trashed) of all their items
BUT because they are not part of the managers ACL group
- they can not see their private message
- they can not edit their private message
- they can not delete their private message
Here is how i fixed it (there may be a cleaner way)
Allowing the user to see their own post
in the Model
component_name/model/tablename.php or administrator/component_name/model/tablename.php
// WHERE : Implement View Level Access
if (!$acl->get('core.admin'))
{
// HACK -------------------------------------------------------------------------
//Allow the author to see its own unpublished/archived/trashed items
// when in lower Viewlevel group
$allowAuthor = '';
if ($acl->get('core.edit.own') || $acl->get('core.view.own'))
$allowAuthor = ' OR a.created_by = ' . (int)JFactory::getUser()->get('id');
// end hack ----------------------------------------------------------------------
$groups = implode(',', JFactory::getUser()->getAuthorisedViewLevels());
$query->where('a.access IN ('.$groups.')'.$allowAuthor); // ------ HACK TO ADD AUTHOR ------
}The user can now see all of their records but where the view access level is manager
the tool bar buttons edit and delete are displayed
BUT they can not see (in the record grid)
- checkbox
- edit button
- delete button
- unpublish button
Also in the grid
- trash button (is displayed and if you select it it prompts "are you sure you want to trash?" but does nothing if selecting ok)
- publish button (displayed but nothing happens when pressed)
- default button (displayed but nothing happens when pressed)
- archive button (displayed but nothing happens when pressed)
- published icon (displayed - unsure if it toggles dont think i set it)
Allowing the user to edit their record
in administrator/components/com_mycomponent/classes/models/item.php
public function canEdit($record, $testNew = false)
{
$acl = BtbtasksHelper::getActions();
//Create instead of Edit if new item
if($testNew && empty($record->id))
return self::canCreate();
//Check if can access
if (!$this->canAccess($record))
{ // hack dont forget braces
// hack -------------------------------------------------------------------------
// to allow user to edit record when in lower Viewlevel group
//Check Author here
if ($acl->get('core.edit.own'))
{
if ($this->isAuthor($record))
return true;
}
// end hack ----------------------------------------------------------------------
return false;
} // hack dont forget braces
//Check if already edited
if (!$this->canCheck($record))
return false;
..........
..........
..........
Now the user can see in the grid and use
- check box
- edit button on toolbar and grid
State Buttons All visable and now indicate "edit state is not permitted you are not authorised to view this resource"
Missing Buttons
- delete button missing from the grid
- Delete from the toolbar indicates "you are not authorised to view this resource"
Allowing the user to the delete their private message
Again in the administrator/components/com_mycomponent/classes/models/item.php
public function canDelete($record)
{
$acl = BtbtasksHelper::getActions();
//Check if can access
if (!$this->canAccess($record))
{ // hack dont forget braces
// HACK ----------------------------------------------------------------------
//Check Author has delete own permission
if ($acl->get('core.delete.own'))
{
if ($this->isAuthor($record))
return true;
}
// End Hack ------------------------------------------------------------------
return false;
} // hack dont forget braces
//Check if already edited
if (!$this->canCheck($record))
return false;
.................
....................
.......................
The User Can Now Successfully Delete the record and the grid icon works
edit state tasks "still prompt edit state is not permitted...."
Allowing the user to edit state
Again in the administrator/components/com_mycomponent/classes/models/item.php
public function canEditState($record)
{
$acl = BtbtasksHelper::getActions();
//Check if can access
if (!$this->canAccess($record))
{ // hack dont forget braces
// hack -------------------------------------------------------------------------
// to allow user to edit record when in lower Viewlevel group
//Check Author here
if ($acl->get('core.edit.state'))
{
if ($this->isAuthor($record))
return true;
}
// end hack ----------------------------------------------------------------------
return false;
} // hack dont forget braces
//Check if already edited
if (!$this->canCheck($record))
return false;
................
................
.................
The user is now able successfully use the...
- trash button
- unpublish button
- publish button
- archive button
- Default Button
PUBLISHED FIELD
- Archive Button (did notice it displays two archived buttons)
- i did catch a 2 in the published field once (should have been -2) unsure how it got there seems to work now?
The Default Field icon is yellow star for 0 and displays no icon for 1 so user cant toggle back
Have not tested checkin / checkout
Any Hope it Helps
