Dynamic user content permission problem

Friday 18 June 2004 12:55:51 am

Im working on a site with strict permissions to protect users privacy.

I store information underneath the user object where each user can create, edit and delete their own objects. I can use the 'Self' limitation to control this.

The problem comes when other authorised users such as editors and admins add objects to this area. When added my user is not able to see the new objects because they do own them. If I replace 'self' with 'any' the objects can be seen but this allows users to read into other users data if they know how to manipulate the url.

What i need is a way of specifying a 'content read *' limited by a subtree which begins at the user object itself. I can of course add this manually but it would be a large overhead for each user (thousands). A workflow could help here but it would be nice if the system could handle this by default.

Is this easy/possible?

Thanks

paul

--
http://www.visionwt.com

Friday 18 June 2004 1:22:01 am

Thanks,

I wonder how templates can solve this? When the user wants to view information they have these permissions:

content, read, Section( NewSection ) , Owner( Self )

If an admin adds an object, such as a Notice item, the user wont be authorised to view it.

Changing the permissions to:

content, read, Section( NewSection )

produces security problems, Users can then read other users information, which we cannot allow.

A subtree based on the used object would solve this. But i'd rather not add thousands of specialised permissions ;)

paul

--
http://www.visionwt.com

Friday 18 June 2004 5:04:16 am

Absolutely! Will you post it as a suggestion, or should I?

Sincerly,

Eirik Johansen
http://www.netmaking.no/

Sincerely,

Eirik Alfstad Johansen
http://www.netmaking.no/

Wednesday 21 July 2004 1:06:19 pm

I'm working on something similar, though I think we can get away with handling most of this with templates. I'm poking around for the exact way to get at user permissions objects, and while I'm sure I'll find it sooner or later, if anyone can point me in the right direction, that would be helpful.

We're very eagerly awaiting our copy of the eZ book. Supposed to be here by Friday!

Monday 23 March 2009 1:20:52 am

Hi,

I have similar problem. I have a gallery that users can upload images. When they upload it creates content object. This facility is provided in the frontend.

The problem is admin users can upload images to the gallery but the users cannot upload images. There is no any error messages in the debug report.

I have given permission to users as follows:

content create Class( Image ) , Section( Photo ) , ParentClass( Gallery )
content edit Class( Image ) , Section( Photo ) , Owner( Self )

Please help!

http://www.eyepax.com