J3.x:Access Control List Tutorial - Revision history

Topazgb: Undo revision 1010302 by Chuyentt (talk)

2023-08-18T15:11:32Z

Undo revision 1010302 by Chuyentt (talk)

← Older revision		Revision as of 15:11, 18 August 2023
Line 8:		Line 8:

	<translate><!--T:4-->		<translate><!--T:4-->
	The Joomla ACL system can be ~~considered~~ divided into two completely separate systems. One system controls what things on the site Users can ''view''. The other controls what things Users can ''do'' (what actions a User can take). The ACL for each is set up differently.</translate>		The Joomla ACL system can be thought of as being divided into two completely separate systems. One system controls what things on the site Users can ''view''. The other controls what things Users can ''do'' (what actions a User can take). The ACL for each is set up differently.</translate>

	<translate>		<translate>
Line 16:		Line 16:
	<translate><!--T:6-->		<translate><!--T:6-->
	The setup for controlling what Users can see is done as follows:		The setup for controlling what Users can see is done as follows:
	* Create a set of Access Levels according to the Categories and/or the combination of categories you wish only logged-in Users to see. N.B. Do not assign any User groups to the new Access Levels.</translate>		* Create a set of Access Levels according to the Categories and/or the combination of categories you wish only logged in Users to see. N.B. Do not assign any User groups to the new Access Levels at this point.</translate>

	<translate><!--T:7-->		<translate><!--T:7-->
	* Create a User Group ~~for each Access Level~~ with 'Registered' as a parent. Using the same names for the User Groups as the Access Levels will prevent confusion later.</translate>		* Create a User Group, with 'Registered' as parent, for each Access Level. Using the same names for the User Groups as the Access Levels will prevent confusion later.</translate>

	<translate><!--T:8-->		<translate><!--T:8-->
	* Edit your new Access Levels and assign the correct (new) User Group to each one. You may also wish to assign the Super User Group (and/or the other default User Groups but not ~~the~~ 'Guest' User Group) to all your new Access Levels</translate>		* Edit your new Access Levels and assign the correct (new) User Group to each one. You may also wish to assign the Super User Group (and/or the other default User Groups but not 'Guest' User Group) to all your new Access Levels</translate>

	<translate><!--T:9-->		<translate><!--T:9-->
Line 28:		Line 28:

	<translate><!--T:10-->		<translate><!--T:10-->
	Any time a User is about to view an item on a Joomla page, the program checks whether the User has access to the item as follows:</translate>		Any time a User is about to view an item on a Joomla page, the program checks whether the User has access to the item, as follows:</translate>
	<translate><!--T:11-->		<translate><!--T:11-->
	# Creates a list of all the Access Levels that the User has access to, based on all Groups that the User belongs to. Also, if a group has a parent group, access levels for the parent group are included in the list.</translate>		# Creates a list of all the Access Levels that the User has access to, based on all Groups that the User belongs to. Also, if a group has a parent group, access levels for the parent group are also included in the list.</translate>
	<translate><!--T:12-->		<translate><!--T:12-->
	# Checks whether the Access Level for the item (article, module, menu item, and so on) is on that list. If yes, then the item is displayed to the User. If no, then the item is not displayed.</translate>		# Checks whether the Access Level for the item (article, module, menu item, and so on) is on that list. If yes, then the item is displayed to the User. If no, then the item is not displayed.</translate>
Line 42:		Line 42:

	<translate><!--T:15-->		<translate><!--T:15-->
	The system for setting up what Users in a User Group can do -- what actions they can take on a given item -- is set up with the Permissions tab of Global Configuration and the Permissions tab of the Options screen of each component. Permissions can also be set up at the Category level for core components and the Article level for articles.</translate>		The system for setting up what Users in a User Group can do -- what actions they can take on a given item -- is set up with the Permissions tab of Global Configuration and the Permissions tab of the Options screen of each component. Permissions can also be set up at the Category level for core components and at the Article level for articles.</translate>

	<translate><!--T:16-->		<translate><!--T:16-->
	* If you wish logged in Users to Create, Delete, Edit State, or Edit ~~their~~ Own for specific Categories, then:</translate>		* If you wish logged in Users to Create, Delete, Edit State or Edit Own for specific Categories then:</translate>
	<translate><!--T:17-->		<translate><!--T:17-->
	** Create a User Group with the Parent as one of your User Groups ~~with~~ Access to the Category(or Categories) you wish this new User Group to modify.</translate>		** Create a User Group with the Parent as one of your User Groups that has Access to the Category(or Categories) you wish this new User Group to modify.</translate>
	<translate><!--T:18-->		<translate><!--T:18-->
	**Assign your new User Group to the appropriate Access Level(s). Then change the required permissions for your new User Group either Globally or per Category/Article.</translate>		**Assign your new User Group to the appropriate Access Level(s). Then change the required permissions for your new User Group either Globally or per Category/Article.</translate>
	<translate><!--T:19-->		<translate><!--T:19-->
	***When creating a User Group~~, selecting~~ a parent group ~~with fewer~~ permissions than needed for the new group ~~is good practice~~. This is because it is easier to elevate permissions per Component/Category/Article that the extra permissions are needed for than it is to remove permissions from the other Components/Categories/Articles.</translate>		***When creating a User Group it is good practice to select a parent group that has less permissions than needed for the new group. This is because it is easier to elevate permissions per Component/Category/Article that the extra permissions are needed for than it is to remove permissions from the other Components/Categories/Articles.</translate>
	<translate><!--T:20-->		<translate><!--T:20-->
	****''(Example: You have ten Categories but want to Create permissions for just one. If you set Global permissions to Allow Create for that group, you ~~must~~ remove Create permission for all those categories. And you would need to remove the Create permission for that group with any new Category that you add at a later date.)''</translate>		****''(Example: You have ten Categories but you want Create permissions for just one. If you set Global permissions to Allow Create for that group you would need to remove Create permission for all those categories. And you would need to remove the Create permission for that group with any new Category that you add at a later date.)''</translate>
	<translate><!--T:21-->		<translate><!--T:21-->
	**Only create a User Group with one of the default User Groups as a parent if none of them have the exact permissions that you need and you wish all Categories</translate>		**Only create a User Group with one of the default User Groups as parent if none of them have the exact permissions that you need and you wish all Categories</translate>

	<translate><!--T:22-->		<translate><!--T:22-->
	Note that this ~~setup~~ is independent of the setup for viewing, but a User Group needs to be assigned to the appropriate Access Level(s) for the User in that Group to use those Permissions.</translate>		Note that this set up is independent of the setup for viewing but a User Group needs to be assigned to the appropriate Access Level(s) in order for the User in that Group to use those Permissions.</translate>

	<translate><!--T:23-->		<translate><!--T:23-->
	When a User wants to initiate a specific action against a component item (for example, edit an article), the system (after checking the Group, the User is in has access) checks the permission for this combination of User, item, and action. If it is allowed, then the User can proceed. Otherwise, the action is not allowed.</translate>		When a User wants to initiate a specific action against a component item (for example, edit an article), the system (after checking the Group the User is in has access) checks the permission for this combination of User, item, and action. If it is allowed, then the User can proceed. Otherwise, the action is not allowed.</translate>

	<translate><!--T:24-->		<translate><!--T:24-->
Line 67:		Line 67:

	<translate>		<translate>

	==Actions, Groups, and Inheritance== <!--T:25-->		==Actions, Groups, and Inheritance== <!--T:25-->
	</translate>		</translate>

Chuyentt at 17:40, 17 July 2023

2023-07-17T17:40:45Z

← Older revision		Revision as of 17:40, 17 July 2023
Line 8:		Line 8:

	<translate><!--T:4-->		<translate><!--T:4-->
	The Joomla ACL system can be ~~thought of as being~~ divided into two completely separate systems. One system controls what things on the site Users can ''view''. The other controls what things Users can ''do'' (what actions a User can take). The ACL for each is set up differently.</translate>		The Joomla ACL system can be considered divided into two completely separate systems. One system controls what things on the site Users can ''view''. The other controls what things Users can ''do'' (what actions a User can take). The ACL for each is set up differently.</translate>

	<translate>		<translate>
Line 16:		Line 16:
	<translate><!--T:6-->		<translate><!--T:6-->
	The setup for controlling what Users can see is done as follows:		The setup for controlling what Users can see is done as follows:
	* Create a set of Access Levels according to the Categories and/or the combination of categories you wish only logged in Users to see. N.B. Do not assign any User groups to the new Access Levels ~~at this point~~.</translate>		* Create a set of Access Levels according to the Categories and/or the combination of categories you wish only logged-in Users to see. N.B. Do not assign any User groups to the new Access Levels.</translate>

	<translate><!--T:7-->		<translate><!--T:7-->
	* Create a User Group, with 'Registered' as parent~~, for each Access Level~~. Using the same names for the User Groups as the Access Levels will prevent confusion later.</translate>		* Create a User Group for each Access Level with 'Registered' as a parent. Using the same names for the User Groups as the Access Levels will prevent confusion later.</translate>

	<translate><!--T:8-->		<translate><!--T:8-->
	* Edit your new Access Levels and assign the correct (new) User Group to each one. You may also wish to assign the Super User Group (and/or the other default User Groups but not 'Guest' User Group) to all your new Access Levels</translate>		* Edit your new Access Levels and assign the correct (new) User Group to each one. You may also wish to assign the Super User Group (and/or the other default User Groups but not the 'Guest' User Group) to all your new Access Levels</translate>

	<translate><!--T:9-->		<translate><!--T:9-->
Line 28:		Line 28:

	<translate><!--T:10-->		<translate><!--T:10-->
	Any time a User is about to view an item on a Joomla page, the program checks whether the User has access to the item, as follows:</translate>		Any time a User is about to view an item on a Joomla page, the program checks whether the User has access to the item as follows:</translate>
	<translate><!--T:11-->		<translate><!--T:11-->
	# Creates a list of all the Access Levels that the User has access to, based on all Groups that the User belongs to. Also, if a group has a parent group, access levels for the parent group are ~~also~~ included in the list.</translate>		# Creates a list of all the Access Levels that the User has access to, based on all Groups that the User belongs to. Also, if a group has a parent group, access levels for the parent group are included in the list.</translate>
	<translate><!--T:12-->		<translate><!--T:12-->
	# Checks whether the Access Level for the item (article, module, menu item, and so on) is on that list. If yes, then the item is displayed to the User. If no, then the item is not displayed.</translate>		# Checks whether the Access Level for the item (article, module, menu item, and so on) is on that list. If yes, then the item is displayed to the User. If no, then the item is not displayed.</translate>
Line 42:		Line 42:

	<translate><!--T:15-->		<translate><!--T:15-->
	The system for setting up what Users in a User Group can do -- what actions they can take on a given item -- is set up with the Permissions tab of Global Configuration and the Permissions tab of the Options screen of each component. Permissions can also be set up at the Category level for core components and at the Article level for articles.</translate>		The system for setting up what Users in a User Group can do -- what actions they can take on a given item -- is set up with the Permissions tab of Global Configuration and the Permissions tab of the Options screen of each component. Permissions can also be set up at the Category level for core components and the Article level for articles.</translate>

	<translate><!--T:16-->		<translate><!--T:16-->
	* If you wish logged in Users to Create, Delete, Edit State or Edit Own for specific Categories then:</translate>		* If you wish logged in Users to Create, Delete, Edit State, or Edit their Own for specific Categories, then:</translate>
	<translate><!--T:17-->		<translate><!--T:17-->
	** Create a User Group with the Parent as one of your User Groups ~~that has~~ Access to the Category(or Categories) you wish this new User Group to modify.</translate>		** Create a User Group with the Parent as one of your User Groups with Access to the Category(or Categories) you wish this new User Group to modify.</translate>
	<translate><!--T:18-->		<translate><!--T:18-->
	**Assign your new User Group to the appropriate Access Level(s). Then change the required permissions for your new User Group either Globally or per Category/Article.</translate>		**Assign your new User Group to the appropriate Access Level(s). Then change the required permissions for your new User Group either Globally or per Category/Article.</translate>
	<translate><!--T:19-->		<translate><!--T:19-->
	***When creating a User Group ~~it is good practice to select~~ a parent group ~~that has less~~ permissions than needed for the new group. This is because it is easier to elevate permissions per Component/Category/Article that the extra permissions are needed for than it is to remove permissions from the other Components/Categories/Articles.</translate>		***When creating a User Group, selecting a parent group with fewer permissions than needed for the new group is good practice. This is because it is easier to elevate permissions per Component/Category/Article that the extra permissions are needed for than it is to remove permissions from the other Components/Categories/Articles.</translate>
	<translate><!--T:20-->		<translate><!--T:20-->
	****''(Example: You have ten Categories but ~~you~~ want Create permissions for just one. If you set Global permissions to Allow Create for that group you ~~would need to~~ remove Create permission for all those categories. And you would need to remove the Create permission for that group with any new Category that you add at a later date.)''</translate>		****''(Example: You have ten Categories but want to Create permissions for just one. If you set Global permissions to Allow Create for that group, you must remove Create permission for all those categories. And you would need to remove the Create permission for that group with any new Category that you add at a later date.)''</translate>
	<translate><!--T:21-->		<translate><!--T:21-->
	**Only create a User Group with one of the default User Groups as parent if none of them have the exact permissions that you need and you wish all Categories</translate>		**Only create a User Group with one of the default User Groups as a parent if none of them have the exact permissions that you need and you wish all Categories</translate>

	<translate><!--T:22-->		<translate><!--T:22-->
	Note that this ~~set up~~ is independent of the setup for viewing but a User Group needs to be assigned to the appropriate Access Level(s) ~~in order~~ for the User in that Group to use those Permissions.</translate>		Note that this setup is independent of the setup for viewing, but a User Group needs to be assigned to the appropriate Access Level(s) for the User in that Group to use those Permissions.</translate>

	<translate><!--T:23-->		<translate><!--T:23-->
	When a User wants to initiate a specific action against a component item (for example, edit an article), the system (after checking the Group the User is in has access) checks the permission for this combination of User, item, and action. If it is allowed, then the User can proceed. Otherwise, the action is not allowed.</translate>		When a User wants to initiate a specific action against a component item (for example, edit an article), the system (after checking the Group, the User is in has access) checks the permission for this combination of User, item, and action. If it is allowed, then the User can proceed. Otherwise, the action is not allowed.</translate>

	<translate><!--T:24-->		<translate><!--T:24-->
Line 67:		Line 67:

	<translate>		<translate>

	==Actions, Groups, and Inheritance== <!--T:25-->		==Actions, Groups, and Inheritance== <!--T:25-->
	</translate>		</translate>

Cmb: Some markup changes.

2023-07-15T21:04:14Z

Some markup changes.

Show changes

Cmb: Words2Watch corrections.

2022-12-11T00:38:16Z

Words2Watch corrections.

Show changes

Cmb: Changes for Words2Watch compliance. Implemented right arrow markup.

2022-09-12T21:58:20Z

Changes for Words2Watch compliance. Implemented right arrow markup.

Show changes

Franz.wohlkoenig: Marked this version for translation

2022-06-09T09:28:04Z

Marked this version for translation

← Older revision		Revision as of 09:28, 9 June 2022
Line 128:		Line 128:
	====Global Configuration==== <!--T:46-->		====Global Configuration==== <!--T:46-->

			<!--T:279-->
	This is accessed from System → Global Configuration → Permissions. This screen allows you set the top-level permission for each group for each action, as shown in the screenshot below.</translate>		This is accessed from System → Global Configuration → Permissions. This screen allows you set the top-level permission for each group for each action, as shown in the screenshot below.</translate>

Line 156:		Line 157:
	====Category==== <!--T:55-->		====Category==== <!--T:55-->

			<!--T:280-->
	Category permissions are accessed in the Category Manager: Edit Category screen, in a tab at the top of the screen. This screen has five permissions, as shown below.</translate>		Category permissions are accessed in the Category Manager: Edit Category screen, in a tab at the top of the screen. This screen has five permissions, as shown below.</translate>

Line 530:		Line 532:
	==ACL Action Permission Examples== <!--T:190-->		==ACL Action Permission Examples== <!--T:190-->

			<!--T:281-->
	Here are some examples of how you might set up the ACL for some specific situations.</translate>		Here are some examples of how you might set up the ACL for some specific situations.</translate>

Franz.wohlkoenig at 09:27, 9 June 2022

2022-06-09T09:27:43Z

Show changes

Franz.wohlkoenig at 09:23, 9 June 2022

2022-06-09T09:23:18Z

← Older revision		Revision as of 09:23, 9 June 2022
Line 10:		Line 10:
	The Joomla ACL system can be thought of as being divided into two completely separate systems. One system controls what things on the site users can ''view''. The other controls what things users can ''do'' (what actions a user can take). The ACL for each is set up differently.</translate>		The Joomla ACL system can be thought of as being divided into two completely separate systems. One system controls what things on the site users can ''view''. The other controls what things users can ''do'' (what actions a user can take). The ACL for each is set up differently.</translate>

	<translate>===Controlling What Users Can See=== <!--T:5--></translate>		<translate>
			===Controlling What Users Can See=== <!--T:5-->
			</translate>

	<translate><!--T:6-->		<translate><!--T:6-->
Line 35:		Line 37:
	Note that Access Levels are set separately for each Group and are not inherited from a group's parent group.</translate>		Note that Access Levels are set separately for each Group and are not inherited from a group's parent group.</translate>

	<translate>===Controlling What Users Can Do=== <!--T:14--></translate>		<translate>
			===Controlling What Users Can Do=== <!--T:14-->
			</translate>

	<translate><!--T:15-->		<translate><!--T:15-->
Line 62:		Line 66:
	The remainder of this tutorial discusses how we control what users can do -- what action permissions they have.</translate>		The remainder of this tutorial discusses how we control what users can do -- what action permissions they have.</translate>

	<translate>==Actions, Groups, and Inheritance== <!--T:25--></translate>		<translate>
			==Actions, Groups, and Inheritance== <!--T:25-->
			</translate>

	<translate><!--T:26-->		<translate><!--T:26-->
Line 88:		Line 94:
	\|}		\|}

	<translate>===How Permissions Work=== <!--T:34--></translate>		<translate>
			===How Permissions Work=== <!--T:34-->
			</translate>

	<translate><!--T:35-->		<translate><!--T:35-->
Line 102:		Line 110:
	* '''Allow''': Allows this action for this level and group and for lower levels and child groups. This does not have any effect if a higher group or level is set to Deny or Allow. If a higher group or level is set to Deny, then this permission will always be denied. If a higher group or level is set to Allow, then this permission will already be allowed.</translate>		* '''Allow''': Allows this action for this level and group and for lower levels and child groups. This does not have any effect if a higher group or level is set to Deny or Allow. If a higher group or level is set to Deny, then this permission will always be denied. If a higher group or level is set to Allow, then this permission will already be allowed.</translate>
	{{anchor\|hierarchylevels}}		{{anchor\|hierarchylevels}}
	<translate>===Permission Hierarchy Levels=== <!--T:40--></translate>		<translate>
			===Permission Hierarchy Levels=== <!--T:40-->
			</translate>

	<translate><!--T:41-->		<translate><!--T:41-->
Line 115:		Line 125:
	# '''Article''': Can override the permissions for a specific article. This level only applies to articles. Other components only allow the first three levels.</translate>		# '''Article''': Can override the permissions for a specific article. This level only applies to articles. Other components only allow the first three levels.</translate>

	<translate>====Global Configuration==== <!--T:46-->		<translate>
			====Global Configuration==== <!--T:46-->

	This is accessed from System → Global Configuration → Permissions. This screen allows you set the top-level permission for each group for each action, as shown in the screenshot below.</translate>		This is accessed from System → Global Configuration → Permissions. This screen allows you set the top-level permission for each group for each action, as shown in the screenshot below.</translate>

Franz.wohlkoenig at 09:21, 9 June 2022

2022-06-09T09:21:34Z

← Older revision		Revision as of 09:21, 9 June 2022
Line 3:		Line 3:
	series </translate>}}		series </translate>}}
	{{-}}		{{-}}
	<translate>==Separate ACL for Viewing and Doing== <!--T:3-->		<translate>
			==Separate ACL for Viewing and Doing== <!--T:3-->
	</translate>		</translate>

Franz.wohlkoenig at 09:20, 9 June 2022

2022-06-09T09:20:50Z

← Older revision		Revision as of 09:20, 9 June 2022
Line 3:		Line 3:
	series </translate>}}		series </translate>}}
	{{-}}		{{-}}
	<translate>==Separate ACL for Viewing and Doing== <!--T:3--></translate>		<translate>==Separate ACL for Viewing and Doing== <!--T:3-->
			</translate>

	<translate><!--T:4-->		<translate><!--T:4-->