I have created a menu item that I only want to show to guest (not to logged in users). I assing acces level 'Guest' to this menu item.
This works perfectly on the front-end: when browsing as a guest you see the menu item, when logged in you do not see it.
But...
When a user with 'Administrator' rights logs into the back-end all menu items with Guest access are not shown. When logging in with Super User rights the menu item is visible.
see screen capture for visual.
maybe related to #5605 ?
Just tested with com_content. It's the same behavior.
So I'm closing this as intended behavior.
A user should only see the items he is supposed to see.
Status | New | ⇒ | Closed |
Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2015-08-27 08:54:45 |
Closed_By | ⇒ | Bakual |
Hi @Bakual , Thanks for your reaction. I have added the user with administrator rights to the Guest group and the menu entry with Guest Acces shows up. This is good :)
What is bad is that this breaks functionality on the front-end for this user :(
What should be hidden for this user is now visible: this impacts not only the menu item but all components that use the guest access...
Of course. But then why should he see an item in the backend which he shouldn't see in frontend?
Because in the back-end he wants to change eg the menu title into eg 'Register now'
On the front-end he (and everybody who is logged in) do not want to 'Register now' (should be hidden) as they are already registered > clicking that menu entry might even result in an error...
Labels |
Added:
?
|
The guest view level is a bit special there, I agree. But I don't see a way how we could work around that. We either applay viewlevels in the backend as well (which indeed makes sense after thinking about it) or we do not. If the admin needs to see them, then the admin has to live with the menuitem present also in frontend.
I think this then also impacts other components that utilize the guest group for showing things only to people not logged in.
I use eg rstbox (popup box) I want the box with the call to action to subscribe to the newsletter only to be shown to guests, not when somebody is logged in.
But I can also understand that perhaps the effort to apply viewlevels in the backend doesn't weight up to the impact on the front-end... It's not affecting all users :) I am not a developer so I have no idea about impact
What we've been experimenting with, for this issue, is to add the Guest group to any user logged in the backend through a modification in the access library (getAuthorizedViewLevels).
Hasn't seen extended usage yet, but so far so good. Managers are now able to see and manage "guest-only" items, and no behavior change in the front-end.
Hi, thanks for the update and your work on it.
Yesterday ran into a 'problem' that has the same root cause.
I have several articles that are only available to a group called 'Customers' (group and ACL). I have set the ACL on the category.
I logged in as Super User, added an article and wanted to reference (hyperlink) an article with the customer ACL set... But I couldn't as these documents where not showing up...
I had to add my super user account to the Customer group and then it worked again... What I would expect is that the super user has all rights regardless of what groups it is a member of, but apparently it doesn't.
Probably one of those very 'rare' use cases but thought I'd mention it here.
What we've been experimenting with, for this issue, is to add the Guest group to any user logged in the backend through a modification in the access library (getAuthorizedViewLevels).
True, you could do that. But it would mean you have to retrieve the component settings from com_users for each query you do (which is quite a code smell), and it is actually confusing when your ACL does include user groups you didn't have specified. You may also run into similar issues with other user groups as well, depending on your setup.
It can be done only once, for the logged user in the backend. It gets cached in a session object, very low risk compared to the benefits.
Any progress in this issue? IMHO the guest access level on the frontend should only be visible for guests. But in the backend a single menu item of access level guest shold be editable for administrators. The way it now works is incorrect imho. It still is in 3.8.0.
@Bakual @Ruud68 I agree to both of your arguments, however one thing that is important to note here that:
Only guest can VIEW the content is not same as only guest can MANAGE the content.
only administrator can MANAGE the content is not same as Only administrator can see the content.
What is wrong here is that we use the access level for both context interchangeably that we should not.
PS: Do not, please do not add all backend users to guest (or any group, for that sake) automatically as @themaze75, if I understand it correct.
You need to allow the admin to see guest menus (add him to the guest group). The menu item list you see is taking into account the access viewlevels. Unless you're a super user.
See https://github.com/joomla/joomla-cms/blob/staging/administrator/components/com_menus/models/items.php#L317-L322
Not sure if this is really intended or not. Imho it should not filter by access levels as those are meant for frontend, not backend. In backend we do the checks on ACL actions.