By Kristofer on

I'm having problems with getting some "create ..."-permissions to stick in Access Control. I have a user role called Content Manager. Those users are supposed to be able to, among other things, create some content types, such as news, but not other such as page or story.

In the Access Control page I have checked the box for 'Create News' while the 'Create Page' and 'Create Story' boxes are unchecked. Still when I log in as a Content Manager I am able to create Page and Story.

Anyone had this problem? What might be wrong?

/Kristofer

⋅ Categories: Drupal 5.x

Comments

matt_harrold’s picture

matt_harrold commented

Have you tried clearing the permissions cache? This is found on the admin/content/node-settings page.

Also the first Drupal user (user/1) is the root user with all permissions. So even if you disallow "Create Page", you'll still be able to. Create a test account with just the Content Manager role, and see if your problem magically disappears when you log in as that user account.

cog.rusty’s picture

cog.rusty commented

Also note that even if you assign your user only the "content manager" role and nothing else, the user is also an "authenticated user" and may get some permissions from that.

Kristofer’s picture

Kristofer commented

Thanks for answering.
I can't find where to clear the cahe. I can't find settings for it on the page you specified. There's setting for "number of posts..", "Length of trimmed posts" and "preview post".

I do have a user with the content manager role and there are permissions for other things that works just as they should (the user doesn't have access for settings etc.).

Kristofer’s picture

Kristofer commented

No more suggestions?
I am able to do other permission-changes that work perfectly so I don't think it can be the cache or wrong user. Is it really this uncommon?
/Kristofer

cog.rusty’s picture

cog.rusty commented

In permission-changes, allowing something is very different from forbidding something. A user can have many roles, and one role is enough to allow something, even if all the other roles "forbid" it. So, roles can't really forbid, they can only allow. To forbid something, none of that user's roles must allow it.

So, you are saying that:
- You are not trying to do this as user #1 (who is above all permissions and roles).
- Your user has a role with "create news" permission but not "create page" or "create story".
- Your user has no more roles (except the "authenticated user" role, which everyone has automatically).
- The "authenticated user" role does not have permissions to "create page" or "create story".
- When you go to admin/content/node-settings you don't see a "Rebuild permissions" button appearing in the middle of the page.

If all these are true, then you shouldn't have this problem... Have you installed (or installed and then uninstalled) any additional access control modules such as og, taxonomy_access, content_access or anything else related to permissions?

Kristofer’s picture

Kristofer commented

So, you are saying that:
- You are not trying to do this as user #1 (who is above all permissions and roles).

No, they are separate users. I use my first user to set permissions and other settings. When I'm logged in with my content manager user I can't access the page for permission and some other administer menu items.

- Your user has a role with "create news" permission but not "create page" or "create story".

That's correct.

- Your user has no more roles (except the "authenticated user" role, which everyone has automatically).

That is correct. I checked it on admin/user/user, and also confirmed it by letting Content Managers have access to view simple menues, wich no other role has (but my first user can see anyway). And when I logged in with my CM-user he could access simple menues. (When I unchecked view simple menu-permission, it disappeared from that user, as it should)

- The "authenticated user" role does not have permissions to "create page" or "create story".

The "authenticated user" role doesn't have any permissions at all except for "access content".

- When you go to admin/content/node-settings you don't see a "Rebuild permissions" button appearing in the middle of the page."

No. Is this also something wrong, or does it differ depending on settings?

Have you installed (or installed and then uninstalled) any additional access control modules such as og, taxonomy_access, content_access or anything else related to permissions?

No, I don't belive so. The modules I have installed are:

CCK
Development
i18n
Views
DrupalAdmin
FCKeditor
IMCE
LoginToboggan(I'm sure the problem existed before I installed this one)
SimpleMenu

An interesting thing happend when I was making sure other permissions worked as they should for the user. I unchecked "administer nodes". Then when I logged in with my CM-user he was suddenly only able to create news and not the page or story!
Of course I can't leave it like that since the user can't edit any content. When I changed it back, the user could create and edit everything again. But maybe it's a clue?

What do you think?

Thanks a lot for taking the time!
Kristofer

cog.rusty’s picture

cog.rusty commented

That was it. "Administer nodes" is too strong. It allows a user to do anything at all with any kind of content, and it should be used with much caution.

Instead of this, there are separate permissions to "edit own news" and "edit news" (anyone's news).

With the help of the http://drupal.org/project/content_access module you could also have separate "view news" and "delete news" permissions, if you needed them.

If the problem is that you need them to have access to node lists like the ones they can see with "administer nodes", you could consider a different method using the http://drupal.org/project/modr8 module.

By the way, the "Rebuild permissions" button appears only under some conditions (when there is something which it could fix), so it is OK.

Kristofer’s picture

Kristofer commented

Hm, I see. The access rules for creating content work as it should with "administer nodes" turned off, but I don't really get access to edit any pages, even when I have the inividual edit permissions activated.

I do have my own page for listing all the content to be edited, but they link to the Drupal standard page for editing a piece of content. For example: /node/336/edit?destination=admin%2Fcontent%2Fnode
But when I click the link I get an access denied message.

Is there still something I need my user to be able to access?

jordibares’s picture

jordibares commented

I am pretty new to Drupal and very confused about the user's architecture, the reason is that we are dealing with status rather than categories for the standard setup (non-auth, auth) versus a category (client, editorial, architect, admin)

Can someone develop what is the best way to organize your users?

I am thinking in just avoiding any settings altogether via the authenticated user as this applies for all users with a log-in and then i have created a client one, and and then an editorial one.

Also if very weird to me the administrator user is not flagged there and in the navigation blocks as this brings a weird side effect.

Let's say you have the Client/Editorial/Admin trio, i don't want the client to have access to the navigation menu but i do want the editorial to have, and of course the admin too.

But if you go to the navigation block the admin flag is not available and therefore i can't find a way to make this happen. Is this the best way? should i have an architect users with full permissions?

thanks so much and sorry if i am touching a recurring subject.

cog.rusty’s picture

cog.rusty commented

Drupal's roles give permissions in an additive way. Essentially the roles of a user work like added properties, not as disjoint full user descriptions (although you can use them as full descriptions, they become harder to maintain and modify).

About navigation, the administration menu is dynamic and depends on a user's roles. Only the allowed administrative options will appear in a user's navigation menu, and if the user has no permissions for any administrative functions, none will appear in the menu for that user.

The philosophy behind this is that administration tasks are often indistinguishable from other tasks. Compare, for example, a CMS where you have to go to a back-end to write a story vs a company intranet where accountants, salesmen, their managers etc participate in content creation and management in one way or another.

jordibares’s picture

jordibares commented

May be i am getting confused with the modules that i have added s i have structured (anonymous / client user / editorial user) i can control it as i was expecting but i found that Daily news and Newsletters do not have user visibility flags and therefore those are shown in the navigation bar.

Still i personally think would be great to have in the default installation some more roles than anonymous/registered and still think registered overriding is kind of weird.

Anyway, thanks so much.

cog.rusty’s picture

cog.rusty commented

If a user has "edit [type] content" permission (but not "administer nodes") and can't edit the nodes, the usual reasons are two:
- Some add-on access control module (taxonomy access, organic groups etc) has been installed (or installed and then uninstalled improperly) and the access permissions are messed up. In this case the "Rebuild permissions" button mentioned previously should fix it (and maybe a glance at the "Uninstall" tab in the admin/build/modules page for leftovers of disabled modules).
- The author of a node has created it using the "Full HTML" or "PHP code" or some custom input format, while the editor is allowed to use only "Filtered HTML" input format. In this case, the "Edit" tab in the node view will just disappear for that user.

Also, if someone does not have a role with "administer nodes", then the "admin/content/node" page is inaccessible no matter how one arrives there. So, probably a custom view would be needed for an overview of the editable nodes.

raindrops’s picture

raindrops commented

The author of a node has created it using the "Full HTML" or "PHP code" or some custom input format, while the editor is allowed to use only "Filtered HTML" input format. In this case, the "Edit" tab in the node view will just disappear for that user.

My users who had edit access were losing it on seemingly random pages. I couldn't figure out why, so I came here looking for some help.

Turns out that every node where they lost edit access, I had edited while logged in with "administer filters," and used Full HTML.

Thanks for the fix, saves me many a headache. I just enabled Full HTML for my users who can edit, they're trusted (may not be workable for some sites).

[EDIT]

After giving it some thought, I decided that granting Full HTML to all my users isn't the best idea, trusted or not. My solution, following what I believe to be best practices:

  • user/1 is an admin only user, and should not be used on a daily basis... make yourself another account with less privileges
  • extend Filtered HTML to be a bit more permissive (the same tags allowed on this site, actually), and make that the default and only input format
    • this allows all users with edit privs to edit others work (we're a non-profit which is actually a coalition of several non-profits, and the site is a collaborative effort where everyone has ownership of all content)
    • this prevents the situation where someone with more privs uses an input filter to edit and thereby leaves the node uneditable by other users
    • it allows you to generate some content that can't be edited by your users, by judicious use of the admin account and Full HTML