Setting up the admin panel of the Modx Revolution client with setting access rights. MODx Revolution: creating resources and loading files from the Modx frontend file source field type image
Good afternoon to all WebHow blog readers! I finally found a great plugin for highlighting code in articles, and now I can get down to serious business. So, jokes aside, today there will be a stern post for those who dream of organizing a bulletin board, catalog or any other service on their MODx site, where visitors will post their own content.
Anyone who is even a little familiar with MODx knows that in order to post content, the user must have access to the admin panel. Of course, I don’t want to distribute it left and right. Therefore, we need to make sure that users can create resources and upload files to them directly from the site pages.
I'm not a programmer, and when I first had to create a message board on MODx, all I could do was look for a ready-made solution. Various options There was quite a bit of snippet that would allow publishing a resource from the front end for MODx Revolution.
The principle is approximately the same for everyone: using FormIt, a page with a form is created, in the call of which the name of the snippet is written. For each type of ad, its own TV fields are created, for example, city, phone, or a field for uploading images. When a user submits a form, a resource is created.
However, almost all the snippets that I managed to find were very cumbersome: each TV parameter had to be written in the snippet code, and this did not suit me. Because for each type of ad, I planned at least 3 additional fields, and all of them should be included in the snippet... no, there is a better and simpler way. I found it on the English-language part of the official MODx.com forum. And if you don’t speak and read English very well or you’re just too lazy to look for a suitable option from several in the topic, I’ll tell you how to use it.
I wrote about this topic step-by-step video instructions. You will find all the materials for it just below the player.
snippet code formit2resource
getObject("modResource",array("id"=>$hook->getValue("resource_id"))); if (empty($doc))( $doc = $modx->newObject("modResource"); $doc->set("createdby", $modx->user->get("id")); ) else ( $doc->set("editedby", $modx->user->get("id")); ) $allFormFields = $hook->getValues(); foreach ($allFormFields as $field=>$value) ( if ($field !== "spam" && $field !== "resource_id")( $doc->set($field, $value); ) ) $ alias = $doc->cleanAlias($fields["pagetitle"]); if($modx->getCount(modResource, array("alias"=>$alias))!= 0) ( $count = 1; $newAlias = $alias; while($modx->getCount(modResource, array(" alias"=>$newAlias))!= 0) ( $newAlias = $alias; $newAlias .= "-" . $count; $count++; ) $alias = $newAlias; ) $doc->set("alias" ,$alias); $doc->set("template", $template); $doc->save(); foreach ($allFormFields as $field=>$value) ( if (!empty($value) && $tv = $modx->getObject("modTemplateVar", array ("name"=>$field))) ( /* handles checkboxes & multiple selects elements */ if (is_array($value)) ( $featureInsert = array(); while (list($featureValue, $featureItem) = each($value)) ( $featureInsert = $featureItem; ) $ value = implode("||",$featureInsert); $tv->setValue($doc->get("id"), $value); $tv->save(); ->refresh(); return true;
formit2file snippet code
user->get("id"); // Path from root that user specifies // create unique path for this form submission $uploadpath = "assets/uploads/".$mydir."/"; // get full path to unique folder $target_path = $modx->config["base_path"] . $uploadpath; // get uploaded file names: $submittedfiles = array_keys($_FILES); // loop through files foreach ($submittedfiles as $sf) ( // Get Filename and make sure its good. $filename = basename($_FILES[$sf]["name"]); // Get file"s extension $ ext = pathinfo($filename, PATHINFO_EXTENSION); $ext = mb_strtolower($ext); // case insensitive // is the file name empty (no file uploaded) if($filename != "") ( // is this the right type of file? if(in_array($ext, $ext_array)) ( // clean up file name and make unique $filename = $counter . "." . $ext; $filename = str_replace(" ", "_" , $filename); // spaces to underscores $filename = date("Y-m-d_G-i-s_") . $filename; // add date & time // full path to new file $myTarget = $target_path . ; // create directory to move file into if it doesn't exist mkdir($target_path, 0755, true); // is the file moved to the proper folder successfully? if(move_uploaded_file($_FILES[$sf]["tmp_name "], $myTarget)) ( // set a new placeholder with the new full path (if you need it in subsequent hooks) $myFile = $uploadpath . $filename;
$hook->setValue($sf,$myFile);
// set the permissions on the file if (!chmod($myTarget, 0644)) ( /*some debug function*/ ) ) else ( // File not uploaded $errorMsg = "There was a problem uploading the file."; $hook->addError($sf, $errorMsg); $output = false; // generate submission error ) else ( // File type not allowed $errorMsg = "Type of file not allowed."; $hook->addError ($sf, $errorMsg); $output = false; // generate submission error ) // if no file, don"t error, but return blank ) else ( $hook->setValue($sf, ""); ) $counter = $counter + 1; return $output;
Friends! Don’t forget to insert your TV fields and the IDs of your resources into the form code. Be careful and you will succeed.
Calling FormIt
[[!FormIt? &hooks=`formit2file,formit2resource,redirect` &redirectTo=`ID of the page with the message` &template=`ID of the ad template` ]]
Condition for calling a chunk with a form
[[!+modx.user.id:is=`0`:then=`To post an ad, authorization is required [[!Loginza? &groups=`3` &profileFields=`username,email,fullname,photo`]]`:else=`[[$form_add]]`]]
Condition for displaying an image
[[*img:notempty=``]]
Now users of your site can not only post advertisements, but also supplement them with photographs, just like on any bulletin board. But what if a mistake was made while filling out the form? For example, a person made a typo and indicated the wrong phone number, or maybe he just wanted to add to the ad or change the price of his product.
Next time I'll tell you... That’s all for today, I hope this article was useful to you.
In Evolution, everything was quite simple: you create rights for the user and you’re done! And here you need to do quite a lot of steps, but on the other hand, in Modx Revolution you can do whatever you want with rights to documents and files (if you understand this, of course). Well, let's begin!
1. Go to "Security" - "Access Control" in the top menu of the admin panel
2. Go to the "Access Policy" tab
3. Click on the “Create access policy” button
A window with fields will open. In the Name field we write “manager”, the access policy template is AdministratorTemplate. Click the save button
4. After saving the “manager” access policy, we see that it appears in our list of access policies
5. Edit manager
6. Uncheck unnecessary parameters
At the bottom of this page that opens there is a list of parameters (permissions). We need to uncheck those parameters that are responsible for displaying any resources in the admin panel in order to avoid editing or deleting the necessary documents, files, elements for the proper operation of the site.
Uncheck the following parameters:
- access_permissions Displays a page with user access rights settings
- dashboards View and manage dashboards
- element_tree Ability to view the element tree in the left navigation panel
- menu_reports Show the “Reports” item in the top menu
- menu_security Show the “Security” item in the top menu
- menu_system Show the “System” item in the top menu
- menu_tools Show the “Tools” item in the top menu
- new_static_resource Create new static resources.
- remove_locks Remove all locks on the site
7. Go to the "Security" - "Access Control" - "Roles" tab
8. Click the "Create new" button, enter Manager, Rank - 9 in the Name field, click the "Save" button
9. Save the changes and go to the menu "Security" - "Access Control" - "User Groups"
Right-click on "Administrator" and click "Create user group"
10. Create a new group: Name - Manager, Backend Policy - no policy, click "Save"
11. Find it in the list of User Groups and click “edit”
12. Go to the "Access to contexts" menu and click "Add context"
13. Context - mgr, Minimum role - Manager - 9, Access policy - Manager
14. Adding another context
Or rather, we edit the existing web: Context - web, Minimum role - Manager - 9, Access Policy - Administrator. Click the "Save" button
15. We will see such a picture! We save everything in the "User group: Manager" tab
16. Next: "Security" - "User Management"
17. Create a new user (this will be our client) - click the “New User” button.
You can give him any name you like, I’ll call him manager
18. Username - manager, click the checkbox - Active, enter email
19. Specify the password
20. Before saving, go to the "Access Rights" tab
21. Click the "Add user to group" button, User group - "Manager", Role - "Manager"
Save. This completes the creation of the admin panel, where the client only has access to editing and creating pages in the document tree. But this user still has access to all files on the system. And so we will now make sure that he only has access to one folder, which we will create in the root of the Modx Revolution site
22. Go to the "Tools" - "File Sources" tab
23. A list of all file sources will open. By default, only one is created - Filesystem
Before creating a new file source, you must first change this one. Right-click on "Filesystem" and select "Edit"
24. The following window will open. Click "Add user group"
25. User groups - Administrator, Minimum role - Super User - 0, Policy - Media Source Admin. Click "Save"
26. Return to File Sources and create a new file source
Let's call it "Manager", File Source Timing - File System
27. Right-click on the new file source “Manager” and select “Edit”
28. A window like this will open! We need to change the first 4 parameters
We enter the value in the basePath field /manager/, basePathRelative and baseUrlRelative are left as is with the values “Yes”, in the baseUrl field we write manager/
29. Go to the TV parameter
30. Click on the very last tab “File Sources”
and change the file source from "Filesystem" to "Manager". Let's save!
31. Add a user group to "Manager"
Now, after all the steps taken, go to “File Source” - “Manager” and add a user group to this file source
32. User groups - Manager, Minimum role - Manager - 9, Policy - Media Source Admin. Click "Save"
Immediately after saving, the "Manager" file source will disappear for the administrator. In order to be able to edit this file source, you need to go to the "Security - Access Control" menu. Open the manager group for editing: Manager and in the “File Sources” tab, find and delete the Manager source. Only then will we be able to edit this source again as an administrator.
33. Just in case, clear the cache
and our user with limited rights and access to the file system has been created!
I won’t say that it’s easy enough, but if you do it automatically, it won’t seem like anything difficult. I hope everything worked out for you! Good luck with your projects!
In Evolution, everything was quite simple: you create rights for the user and you’re done! And here you need to do quite a lot of steps, but on the other hand, in Modx Revolution you can do whatever you want with rights to documents and files (if you understand this, of course). Well, let's begin!
1. Go to "Security" - "Access Control" in the top menu of the admin panel
2. Go to the "Access Policy" tab
3. Click on the “Create access policy” button
A window with fields will open. In the Name field we write “manager”, the access policy template is AdministratorTemplate. Click the save button
4. After saving the “manager” access policy, we see that it appears in our list of access policies
5. Edit manager
6. Uncheck unnecessary parameters
At the bottom of this page that opens there is a list of parameters (permissions). We need to uncheck those parameters that are responsible for displaying any resources in the admin panel in order to avoid editing or deleting the necessary documents, files, elements for the proper operation of the site.
Uncheck the following parameters:
- access_permissions Displays a page with user access rights settings
- dashboards View and manage dashboards
- element_tree Ability to view the element tree in the left navigation panel
- menu_reports Show the “Reports” item in the top menu
- menu_security Show the “Security” item in the top menu
- menu_system Show the “System” item in the top menu
- menu_tools Show the “Tools” item in the top menu
- new_static_resource Create new static resources.
- remove_locks Remove all locks on the site
7. Go to the "Security" - "Access Control" - "Roles" tab
8. Click the "Create new" button, enter Manager, Rank - 9 in the Name field, click the "Save" button
9. Save the changes and go to the menu "Security" - "Access Control" - "User Groups"
Right-click on "Administrator" and click "Create user group"
10. Create a new group: Name - Manager, Backend Policy - no policy, click "Save"
11. Find it in the list of User Groups and click “edit”
12. Go to the "Access to contexts" menu and click "Add context"
13. Context - mgr, Minimum role - Manager - 9, Access policy - Manager
14. Adding another context
Or rather, we edit the existing web: Context - web, Minimum role - Manager - 9, Access Policy - Administrator. Click the "Save" button
15. We will see such a picture! We save everything in the "User group: Manager" tab
16. Next: "Security" - "User Management"
17. Create a new user (this will be our client) - click the “New User” button.
You can give him any name you like, I’ll call him manager
18. Username - manager, click the checkbox - Active, enter email
19. Specify the password
20. Before saving, go to the "Access Rights" tab
21. Click the "Add user to group" button, User group - "Manager", Role - "Manager"
Save. This completes the creation of the admin panel, where the client only has access to editing and creating pages in the document tree. But this user still has access to all files on the system. And so we will now make sure that he only has access to one folder, which we will create in the root of the Modx Revolution site
22. Go to the "Tools" - "File Sources" tab
23. A list of all file sources will open. By default, only one is created - Filesystem
Before creating a new file source, you must first change this one. Right-click on "Filesystem" and select "Edit"
24. The following window will open. Click "Add user group"
25. User groups - Administrator, Minimum role - Super User - 0, Policy - Media Source Admin. Click "Save"
26. Return to File Sources and create a new file source
Let's call it "Manager", File Source Timing - File System
27. Right-click on the new file source “Manager” and select “Edit”
28. A window like this will open! We need to change the first 4 parameters
We enter the value in the basePath field /manager/, basePathRelative and baseUrlRelative are left as is with the values “Yes”, in the baseUrl field we write manager/
29. Go to the TV parameter
30. Click on the very last tab “File Sources”
and change the file source from "Filesystem" to "Manager". Let's save!
31. Add a user group to "Manager"
Now, after all the steps taken, go to “File Source” - “Manager” and add a user group to this file source
32. User groups - Manager, Minimum role - Manager - 9, Policy - Media Source Admin. Click "Save"
Immediately after saving, the "Manager" file source will disappear for the administrator. In order to be able to edit this file source, you need to go to the "Security - Access Control" menu. Open the manager group for editing: Manager and in the “File Sources” tab, find and delete the Manager source. Only then will we be able to edit this source again as an administrator.
33. Just in case, clear the cache
and our user with limited rights and access to the file system has been created!
I won’t say that it’s easy enough, but if you do it automatically, it won’t seem like anything difficult. I hope everything worked out for you! Good luck with your projects!
An article in which we will look at how the access rights system is organized in MODX Revolution, as well as some standard instructions for setting permissions for users.
Access rights system in MODX
MODX Revolution does not allow you to directly assign rights to a user. In this system, this action is carried out through group of users.
In other words, in order to grant a user some rights, it is necessary:
- create a group and assign the necessary privileges to it;
- place one or more users in this group.
But being a user in a group does not mean that he will receive all its privileges. The rights that the user will receive will be determined using the role assigned to him in this group. A user's role (rank) in a group is determined using a number from 0 to 9999. This value determines which user will receive group privileges and which will not.
In other words role is a mechanism that allows different users within the same group to assign different rights.
Let's look at a small example.
In this example:
- User User1 belongs to the group Group1. He has those group privileges whose role is greater 2000 .
- User User2 consists of 2 groups. It has 2 group privileges. From the first group ( Group1) he has those privileges whose role is greater than or equal to 1000 . And from the second ( Group2) - those privileges whose role is greater than or equal to 9999 .
- User User3 is in the group Group2. This group gives him those rights whose role is greater than or equal to 5000 .
MODX Access Policy
Setting group privileges in MODX Revolution is done using access policies. Access policies are assigned to a group in relation to certain MODX entities, namely context, resource group, element category, file source and namespace. In addition, it is also indicated minimal role, which the user of this group needs to have these privileges.
Let's look at the image.
The privileges that users of a group receive, depending on the role each of them plays in it 
In this example:
- User User1(role in Group1 - 2000 ) has all group privileges Group1, whose role is greater than or equal to 2000. I.e. This K1, K2 And G2.
- User User2 has the highest role in the group (0) and therefore all its privileges ( K1, K2, G1 And G2).
- User User3 has in the group Group1 lowest role ( 9999 ). In accordance with it, he can perform actions in the system defined in K2 And G2.
An access policy is a set of rights granted to a user to perform actions on a website running CMS MODX Revolution.
Why is it implemented this way? This is due to the fact that there are a lot of rights in MODX and it is more convenient to assign them in groups (in other words, using an access policy), rather than one at a time.
For example, access policy Load, List and View has the following set of permissions:
- load (load objects);
- list (get a collection of objects);
- view (viewing objects).
How to create your own access policy
When setting permissions for a group of users, you are not limited to the existing (pre-installed) policies in the MODX system. If necessary, you can create new ones. Policy creation in MODX is based on access policy template. An Access Policy Template is a MODX Revolution entity that defines the maximum list of permissions available when creating an Access Policy.
Thus, in order to create an access policy with the required permissions necessary:
- Find a suitable access policy template (if necessary, edit an existing one or create a new one).
- Create an access policy by selecting the appropriate template.
- From the entire list of permissions offered by the template, include only those that you want to grant to users (if they will have this policy).
When creating an access policy, always start by assigning the minimum number of rights that are sufficient for the user to perform certain actions in the system. If necessary, you can always expand the permissions granted to the user.
Anonymous user
In MODX Revolution, any unauthorized visitor to the site is anonymous and belongs to the group (anonymous). You can easily verify this if you create the following snippet, place its call in the resource template, and then open the page.
Php snippet code GetUser:
user->get("username");
Calling a snippet on a page:
[[!GetUser]]
Result:
(anonymous)
The actions of anonymous users on a site in MODX are regulated by setting group permissions (anonymous). If necessary, you can give this group additional privileges or limit them.
Typical instructions for setting permissions
In this section, we'll look at instructions that you can use when you need to:
- restrict access to certain resources for anonymous users;
- create a content manager who needs to be given access to work with resources in the admin panel, as well as the ability to upload pictures.
Restricting access to certain resources
Let's consider an example in which we will restrict access to certain resources for anonymous users (for example, to a personal account, to the “Password Change” page, etc.). We will provide access to these resources only to registered users.
To do this you need:
- Create Users resource group(Content -> Resource Groups -> “Create Resource Group” button). In the form that appears, enter in the “Name” field - Users and click on the “Save” button. Place the necessary resources in it (access to which must be limited for anonymous visitors).
- Create user group Users(Gear icon -> Access control -> New user group button). In the dialog box that opens, enter in the “Name” field - Users, "Contexts" - web, "Backend Policies" - (no policy).
- Go to group editing mode (in the Users context menu, select “Edit user group”).
- Open the “Access Rights” tab, and in it “Access to resource groups”. Click on the “Add resource group” button and fill out the form that opens (“Resource group” - Group, "Context" - (web), Minimum role – Member (9999), “Access Policy” – Load, List and View).
After this, any anonymous or other user (who does not have rights) will receive 404 resource(since he doesn’t even have the right load) if he tries to open any page from this group.
If you want anonymous users, when opening protected pages, to be sent to some other (for example, authorization), then you need to additionally do the following (namely, give the right load for this resource group):
- Open system settings(Gear icon -> System settings). Select the “core” namespace, “Site” section. Find parameter unauthorized_page(Error page 403 “Access denied”) and give it the value - resource id containing the “Authorization” form.
- Go to group editing mode (anonymous). In the “Access to resource groups” section (the “Access Rights” tab), add Users resource group and give it the necessary rights (in this case “Context” - (web), Minimum role – Member (9999), “Access Policy” – Load Only).
Setting permissions for the content manager
In this example, we will create a “Managers” group, whose users will be able to upload images to a directory in the admin panel and work with certain resources.
To do this, you can, for example, use the following instructions:
1. Create a new one Access Policy Manager with the necessary rights:
- Open the “Access Control” page (Gear icon -> Access Control) and go to the “Access Policy” tab.
- Make a copy of the “Content Editor” policy.
- Edit the created copy, namely change the name field to Manager and check the boxes next to the rights directory_list, file_list, file_manager, file_remove, file_tree, file_upload. As a result, the Manager access policy will have 30 permissions. This must be done in order to grant the user rights to work with files.
- Click on the “Save” button.
2. Hide resources that managers should not have access to in the admin panel:
- Open the “Resource Groups” page and click on the “Create Resource Group” button.
- In the form that opens, enter in “Name” - ClosedForManagers, "Contexts" - mgr And Mark"Automatically grant access to the Administrator group" option.
- Click on the “Save” button.
- Drag resources that need to be hidden for managers in the admin panel to the created group.
3. Provide access to the directory into which the user will upload pictures.
- Open the “File Sources” page, click on the “Create a new file source” button.
- In the form that opens, enter the text in the “Name” field Images, in “Description” - Images, in “File source type” - File system.
- Click on the “Save” button.
- Edit the newly created file source (right mouse button -> “Edit” action).
- Change the value of the parameters: basePath – assets/images/, baseUrl – assets/images/ allowedFileTypes - jpg, jpeg, png, gif.
- Click on the “Save” button.
A file source that does not have a user group associated with it will be available to all backend users. Therefore, to prevent other file sources that are not associated with one group from being shown to users of the Managers group, they can, for example, be assigned to the Administrator user group.
MODX - Associating a Filesystem file source with the Administrator group 
The MODX access control system using a file source allows different users to specify specific directories to which they will have access, as well as define the set of their privileges in them. In other words, this is a system with the help of which, for example, some users can be given some directories, and others - others.
4. Create new user group and assign it the necessary rights.
- Open the “Access Control” page, go to the “User Groups & Users” tab, click on the “New User Group” button.
- In the dialog box that opens, fill in the following fields: “Name” - Managers; "Description" - Managers; "Contexts" - web, mgr; "Backend Policy" - Manager.
- Click on the “Save” button.
- Go to the editing mode of the newly created user group “Managers” (right-click on the group -> item in the context menu “Edit”).
- Go to the "Access Rights" tab.
- Open the “Access to contexts” section. Access to context web: “Minimum role” - Member (9999); Access Policy – Load, List and View. Access to context mgr: “Minimum role” - Member (9999),Access Policy – Manager.
- In the “Access to file source” section, add a new entry with the following values: “Source” - Images; "Minimum role" - Member (9999), “Access Policy” – Media Source Admin.
- Click on the “Save” button
5. Create user and add it to the “Manager” group. Set the role value to 9999 (Member). This role will be enough for him to obtain all the permissions of this group. This is due to the fact that for this group we did not assign access policies that would require a role greater than 9999.
Adding a user to the Manager group (Member role) 