I am trying to create user rights in Typo3 7.6 so that a user can simply work as an editor. He has, for his department, a section of the page tree. In that he can almost exclusively create text & media. For a single subpage of this whole tree, it also requires the ability to create an HTML element.
From my personal logic, it would be sufficient to create a user group (A), with all the usual rights would be covered. So creating pages, texts and media. A second user group (B) then only with the explicit permission to create HTML elements. Under Access, I have selected the group in the entire page tree as a simple editor (A), under which one page may be on the HTML, but the second user group (B).
But now it seems that as soon as the user receives the group B, it is not only allowed to create HTML for the one page, but the entire page tree.
What am I doing wrong? How is that otherwise thought?
This doesn't work this way. The permissions of all groups are combined and are the same on any page.
A possible solution could be to use the extension content_defender and a different backend layout for those pages where the HTML element is allowed.
Just as a side note: Allowing an editor the HTML element is a security risk as the editor can also create JavaScript and with that can get admin permissions and other stuff. So I would be very careful with that and would avoid allowing this element for admins.
Related
I created an extension with the extension builder.
On saving I get this message:
The object was updated. Please be aware that this action is publicly accessible unless you implement an access check. See https://docs.typo3.org/typo3cms/extensions/extension_builder/User/Index.html
How can I fix this issue? Yes I read the page but there are no useful hints.
Since the question is how you can "fix the issue": There is no issue, it is a warning, you can remove it and make your request secure. (As in the other answer.)
The "hint" on the page is actually very straightforward. The "issue", that a user is able to manipulate the url and make the server to execute a not wanted action.
Here is an example:
You have a list of users of your page and you can open thier public porfile for more information:
https://yourdomain.com/list/?tx_ext_plugin['action']=show&tx_ext_plugin['userId']=41.
So if I want to make some trouble, I change the action "show" to "delete" and may I am able to delete the poor user "41" from the db. That is bad.
https://yourdomain.com/list/?tx_ext_plugin['action']=delete&tx_ext_plugin['userId']=41.
So since it is you business logic typo3 offers no out of the box solution for this. That is why this warning from extension builder says, that you need to make actions to prevent misuse.
Regarding how to implemnt a better security here are some thoughts about the Access Control and some ideas what to implement in your actions:
1) FE
You can separate your actions into different plugins. So if you have a public list action it can not be modified to the plugin that responsible for the delete action. How is it possible? TYPO3 will look the page record in your database. And will render it, and if there is a plugin on the page with the signature "tx_ext_plugin" then it will get the sent parameters. In this case you have the possibility to add the different plugins to different pages so changing the signature of it for an attacker won't help, because:
If the delete action is not registered by the plugin, TYPO3 will
throw an exception.
If you are trying to change the whole signature the page won't be able to identify the plugin.
You can add the edit / delete plugin to pages where a user has to be logged in. You can even manage multiple usergroups. Like normal user can only edit its profile, but a premium user can make further changes. You can use in fluid a view helper IfHasRole that can show parts of your template for defined user groups. (There is an ifAuthenticated ViewHelper too)
You can take the extension "femanager" as an example. There is a controller "EditController", that covers actions like "update" and "delete". For example before making the update action there is a check if the logged in user has the same user id as the record which going to be changed. If you have a complex example you can make a check on the user group also.
2) BE
It is actually almost the same as frontend.
BUT instead of plugins / user groups assigned in page settings. You can use different mountpoints, so BE users can not see folders where they are not allow to edit / delete.
You have those two ViewHelper for the BE too. There names are: f:be:security.ifAuthenticated and f:be:security:ifHasRole. However ifAuthenticated is also for FE, in a BE context it does not make sense.
You have also the possibility to identify the id and userGroups of the BE user and you can make your own checks before you let an action run.
You have also the possibility to turn on / off a module for a certain BE group.
+1: It is nothing to do with any action but just to list it too. There is also the possibility to allow / disallow field for BE Users by editing a record through the List mode in the BE.
Extension builder creates dummy actions to update and create records. Those example actions do not contain any security checks, whether the caller actually is allowed to do so.
So it is your job to add adequate access control to those methods. E.g. make sure the current user (be it Frontend or Backend) is actually allowed to update the model in question.
I want to "hide/deactivate" the table element for specific users/usergroups in the typo3 BE.
Or to be more clear: I want to ONLY allow it to ONE specific user (admin).
How can i do that?
NOTE: At the moment the table element is deactivated in the global TS-config via tt_content removeItems().
TIA
Note: I have only an old Typo3 4.3.5 installation, but I hope this hasn't changed much.
In User admin, edit group permissions and go to Access lists. At the bottom is "Explicitly allow/deny field values" where you can restrict specific content types.
With the restriction, affected users still see the restricted content element in BE, but get a message when trying to edit it.
I want to hide a page in navigation component based on the logged in user. I have two approaches in mind. Set permissions on the page's node in CRX-DE; denying it for all users; and then allowing it for specific groups. I have been trying it; not found much success. Else; I can get the id of the logged in user in the jsp and based on the user group; I can set the page's property 'Hide in Navigation' . But I am not able to find how to set that property in jsp. Please suggest.
Edit:
I am using the default authentication.I wanted to hide a page from navigation in the default 'list' component. If I use CUG; the users belonging to that group will still be able to see that particular page's link in the list component; and would be asked for login on clicking on that page.I want the link itself to be hidden if the user belonged to a particular group
Thanks.
If you are using the default authentication features in AEM (like Geometrixx), which rely on users that exist in AEM, you can use Closed User Groups. CUG allows you to set what users or groups can or cannot see a specific page. You can see where to set CUGs in the page properties dialog for each page. I'm pretty sure CUG settings inherit down the page hierarchy as well.
Using the JCR permissions for this is a good deal more complex, because it's such a low-level architectural thing. However, for more complex solutions, sometimes it's a necessary part of the equation.
I agree with ryanluka that going for JCR permissions should be avoided when the problem can be solved by much simpler approach. I modified the list.jsp of the default list component. Extracted the login user's id using Userpropertiesutil; and based on the group; wrote the code in jQuery to remove that particular page's div from list component.
I have three separate user group say HR, IT and Supplies this three groups have their own sub sites.
HR=/site1
IT=/site2
Supplies=/site3
but they have a common top level site say "http://xyz.com"
When a user from HR opens the top level site he should be redirected automatically to the respective sub-site (site1) similarly IT to site2 and same with Supplies.
Can this be done using OOTB method.
If your site is using unique permissions at subsite level, following might work. I am explaining it for a single group IT:
[1] Add content editors in your welcome page of root lelvel site.
[2] Set chrome type to none, and set all it sharepoint groups in audience
[3] set content to
<script type="text/javascript">window.location.href='/IT/';</script>
Same way add content editor web part for each subsite.
This way, if someone from IT group logs in, then and then the content editor web part become visible and the script redirects them to IT home page. This is just a hint, not a real solution.
Draw backs:
[1] Admins will also redirect to the same page and no one will be able to edit the page.
[2] Someone having permission to access more than one department will redirect to any site randomly based on script execution order.
There are ways to improve script written in content editor web part to overcome both of the above changes. You can simply using sharepoint javascript api to improve the script.
Let me know if this makes sense.
How do I hide the content resource field from non-admin users?
So you'd like a user to be able to change document fields such as title, alias etc but not the content?
You can not lock individual fields to admin user (as far as I know). You can either lock the whole page/resource or you could put the content that you want to be locked into the template for that document and lock the template to only the admin user which would achieve the same effect.
Make sure you don't have a reference to [+content+] in the template and even if the user enters document content it won't impact the page.
New answer instead of editing the above as this is a much cleaner solution.
Create different user groups eg. Admin & Editor
Make sure admin is in the admin user group
Create a template variable for your content and in the Access Permissions section only tick the admin group.
Assign the TV to your template.
Now if the user isn't in the admin user group the TV won't even be visible when they are editing the resource.
Hey, thanks for the answer.
I thought I'd post what I ended up doing.
With MODx Evo 1+, you have managermanager included. After removing the included file(which is used rather than the default chunk) using the rules in there I can rename hide and sync content.