On 2/2/06, sharif islam <[EMAIL PROTECTED]> wrote:
> According to this page: http://solprovider.com/lenya/security lenya
> (1.2) cannot assign specific permissions to groups:
>
> " This is a hack because Lenya 1.2.2 does not meet its own specifications:
> Excerpt from http://lenya.apache.org:
> Security: The access control allows you to restrict access to parts of
> your site to members of a group or individuals.
> This may be possible, but it is not easy, and cannot be configured by
> the typical developer (meaning I could not figure it out, and my
> skills are advanced well beyond the typical developer.) "
>
> I created a group called 'myGroup' with a member 'newUser'. Then I
> created a new page under the home directory login in as admin. I gave
> edit role to the group 'myGroup' for that new page. (Home->newpage).
> I was able to edit the new page only after I added 'newUser' to the
> edit group. However, that also allowed me to edit the Home page. I
> didn't want that. This seems to be a pretty basic functionality. I am
> not sure what I am missing.
I love being quoted, but that page is about limiting access for
"Member's Only Sections" while reading the website. It does not
concern authoring/editing documents (although a side effect of using
those instructions is an editor who edits a page they cannot access
will not see the previous contents, and it will not appear in the
"Authoring" menu, but the "Site" tab is a hole.)
My opinion is each Document should enforce its own security
("adminGroup" and "group1" can read and edit, "group2" can read,
"registered" can read or not, "anonymous" can read or not); a Document
should not appear on menus if you do not have read access, and
accessing anything without read access responds "This resource does
not exist or you are not authorized to access it." (same message if
the link is bad or the resource does not exist.)
There have been improvements in Lenya's security since 1.2.2, and
hopefully someone knowledgeable about them will respond. What version
are you using?
solprovider
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
