Deny "modify" privilege for a page.

Bryan Johnson asked on April 6, 2016 17:40

I'm struggling with per-page permissions. I have a Role defined for a set of editors who should only have access to a few pages within the content tree. I am able to deny the "modify" privilege for the role on a page. However, this only seems to prevent changes made in the Form tab. The user is still able to make content changes in the Page tab. What am I doing wrong? Shouldn't the "modify" privilege cover both the Form and the Page tab? Kentico version 9.0.11.

Recent Answers


Bryan Soltis answered on April 6, 2016 22:54

Hi Bryan,

In my demo site I did the following:

  • Created a StoreEditors role
  • Placed Andy in the StoreEditors role
  • As an admin, I add the Deny permission for "Modify" for the About Us page for the StoreEditors group
  • Logged in as Andy and confirmed I could not edit the About Us page (Page / Design / Form tabs)

Are you seeing a different behavior?

-Bryan

0 votesVote for this answer Mark as a Correct answer

Bryan Johnson answered on April 6, 2016 22:59

Hi Bryan, Thanks for looking into it. It appears that I'm only seeing the problem when I impersonate the user. When logged in as the user, it seems to work as expected. I'll play around with it some more to be better understand what's going on before I comment more. Bryan

0 votesVote for this answer Mark as a Correct answer

Bryan Johnson answered on April 6, 2016 23:20

I looked into this some more and there appears to be a bug when in impersonation mode. Editing is still possible in the Page tab, even when "modify" is denied while impersonating a user. However, if logged in as the user, both the Page tab and the Form tab are restricted, as they should be.

0 votesVote for this answer Mark as a Correct answer

David te Kloese answered on April 7, 2016 11:08

Hi,

I'd say report it to support @ Kentico.com, they might have a fix or could explain if its an intend feature.

David

0 votesVote for this answer Mark as a Correct answer

   Please, sign in to be able to submit a new answer.