We have encountered a situation in where a content manager started messing around with the custom fields we created for the site in stead of just using the article creation to create what they needed.
We would like to be able to add permissions the subitems of 'articles' -> 'fields' and 'fieldgroups' in the Joomla backend. So logged in users can have rights to edit articles, but no access to (or rights to) add / remove or edit custom fields for articles.
We can enable and disable custom fields in the site settings (right?) but maybe it would also be possible to assign an access level to this functionality? This would then apply to all custom fields in all components that is is used.
Any thoughts?
Labels |
Added:
?
|
Status | New | ⇒ | Information Required |
@Bakual I am not referring to the view or access permission to individual fields that are created. I would like to be able to restrict access to the fields and fieldgroups functionality as a whole. So these items are not visible / accessable to some users in the backend. The menu items won;t show up in the submenu of the articles (list) in the backend.
Maybe an option to select usergroups that can access these parts of the site in the same place where we can turn the fields functionality on/off (sitewise).
Hope this clarifies things?
That's the "Permission" tab I was referring to. It doesn't hide the menuitem but the fields and fieldgroups can be restricted to certain users, both for editing the value and the field/fieldgroup itself.
For the menuitems, you could create a custom backend menu.
So from my understanding everything is already there. If you can't figure out how it works, please use the forums for further help.
I'm closing this issue for now. If it turns out it's indeed something missing in core, you can always reopen this issue.
Status | Information Required | ⇒ | Closed |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2019-03-20 11:02:24 |
Closed_By | ⇒ | Bakual |
Thanks for your assistance. And you are correct to say that we are able to prevent editing of fields and groups for specific user groups. So we can prevent some backend users to mess with these fields and their settings. That's great.
The only thing we won't be able to prevent is certain user groups adding new field groups and fields. Am I correct? That would only be possible when we prevent access to the fields and field groups all together... Or prevent creating new groups and fields. But I believe that is not possible at this time.
We have tried creating a custom backend menu, but when we add the article listing to it all the sub-items (Articles, Categories, Special articles, Fields, Field groups) are also visible / accessible. I believe we can not create menu items only to these sub-items. But I might be wrong about that... If so that would be a way to prevent some backend user groups to access these items.
Thanks for bearing with me...
Not yet. If this it not the place to discuss this, then sure, I will try it there....
If you have questions how to set up your fields so your manager can't edit them, feel free to use the forums (http://forum.joomla.org)
I don't have questions about that (anymore) ;-) My only remaining question is about accessing the fields and field group functionality as a whole. So a backend user can be restricted from accessing this functionality to add new fields (at all). But I believe that is not possible at this time.
So a backend user can be restricted from accessing this functionality to add new fields (at all). But I believe that is not possible at this time.
yes
you can control
deleting, publishing, editing field configuration, editing field values
but there is no special ACL to handle creating new fields,
instead the core.create on the current component is used,
meaning if a user can create articles then the user can create new fields and field-groups too
see here:
https://github.com/joomla/joomla-cms/blob/staging/administrator/components/com_fields/controllers/field.php#L57-L62
https://github.com/joomla/joomla-cms/blob/staging/administrator/components/com_fields/controllers/group.php#L86-L91
OK, thanks ggppdk! That's what I thought...
So the remaining question is: Would it make sense to have ACL handle the creation of new fields/groups or not? I would think this might be useful in some scenario's?
If so having an ACL setting alongside the option to enable/disable custom field might be a way to go.
I am not a coder... So I can not help with coding this unfortunately. I don't mind doing some testing if needed.
Thanks for listening so far.
Fields and fieldgroups use the same permissions as the component they belong to. So yes, someone who can create an article can also create a field.
You can restrict this permissions on a fieldgroup level, locking that group to only the fields you want.
Adding own permissions just for the fields/fieldgroups would complicate code and UX and I think it would prevent inheritance. of the permissions (from global and component level).
Better to educate the user.
OK, thanks for your thoughts!
For Joomla 4/5 please edit
administrator/modules/mod_menu/src/Menu/CssMenu.php
replace line 349 > if (isset($query['context'])) {
with > if (isset($query['context']) && $user->authorise('core.admin')) {
this restricts the admin menu access to content fieldgroups and fields to superusers.
Maybe this is a workaround, that will help you.
Please be aware this is a core hack and must be done every time when the file is updated bei Joomla Updates.
Access levels would be who can view the item. You can already set that one for both the group and field.
What you probably mean are the permission settings where you can set if someone can edit a field or its value. That is also already possible using the "Permissions" tab in the field / group.
If I misunderstoof your request, feel free to clarify. Otherwise please close this issue.
If you have questions how to set up your fields so your manager can't edit them, feel free to use the forums (http://forum.joomla.org)