Group admin that created layout cannot update the duration in any timeline after upgrade to 1.4.1

Asked by David Coleman

I have fixed the security on the displays, layouts, regions and timelines. At least I think I have.

The group admin can update everything except the duration field(s).

If I change them to a super admin, then they can update the duration field(s).

This same admin can update the duration fields in the "media" objects in the media menu.

I'm just trying to figure out what else I have missed security wise.

By the way I have give security through group permissions not through the user permissions.

Thanks for any help on this.

Question information

Language:
English Edit question
Status:
Answered
For:
Xibo Edit question
Assignee:
No assignee Edit question
Last query:
Last reply:
Revision history for this message
Dan Garner (dangarner) said :
#1

Which type of media are you noticing this on? It was a requirement in the spec for permissions that only the owner/super admin can edit the permissions of an existing media item.

"This same admin can update the duration fields in the "media" objects in the media menu." << this bit shouldn't happen

Revision history for this message
David Coleman (david-coleman) said :
#2

Neither the owner or any member of the group that has permissions can edit the "duration" field.
In this particular case there is a web page, a video and an embedded html. They cannot edit any one of them.
The steps that the person takes is to go to the design -->> Layouts --> click design on the layout to change --> click edit timeline --> then click edit on the object they are going to update. No matter which object they go to they cannot edit the "duration" field. You can click into it, but cannot change it.

They can edit everything else.
So I have temporary enabled the person to be a super admin. (This location has only 1 person updating).

I have some screen dumps that have have a little more detail.

Also - these were not created after the upgrade, but before.

How can I get you the screen dumps? (if you would like to see them).

Revision history for this message
Dan Garner (dangarner) said :
#3

Ah... I think I can see what the problem is....

Prior to the upgrade there wasn't a concept of a specific user assigning content to a region. The assignments were owned by the person that owned the layout. When we introduced the permissions model we started caching the owner of each assignment so that we could work out their permissions (allowing multiple users to edit the same layout)

This was updated for new assignments, but not for prior assignments.

The same is true for regions, except that the first time an old layout was edited... the owner of the layout got copied over as the owner of the region.

I think we can apply the same logic to media assignments by replacing line #188 in lib/modules/module.class.php with:

// If the userId is blank, then set it to be the layout user id
            if (!$this->originalUserId = $mediaNode->getAttribute('userId'))
                $this->originalUserId = $db->GetSingleValue(sprintf("SELECT userid FROM layout WHERE layoutid = %d", $this->layoutid), 'userid', _INT);

Can you try this out and let me know?

Revision history for this message
David Coleman (david-coleman) said :
#4

Thanks Dan - sorry it took me so long to be able to test this.

That works for the owner of the layout - I changed the code and the owner can now logon and change the duration field.

However I tested logged in as someone else that is in the group that has permissions and the user cannot change the duration field.

They can change everything else...

Revision history for this message
David Coleman (david-coleman) said :
#5

I see that you have put this into a fix - but was wondering about the group access.

I have groups here that have to have access rather than just the creator.

Thanks for any info you can give me on this.

Revision history for this message
Dan Garner (dangarner) said :
#6

Yeah, unfortunately that was not in the original spec for the permissions model, so there isn't any way to get that set. We would have to extend the model to include an option such that "only the owner can edit duration" - so this can be tweaked on an install by install basis.

Please feel free to add a blueprint for this and target it to the 1.7 series.

Revision history for this message
David Coleman (david-coleman) said :
#7

Here is my dilema - I have multiple departments that have multiple layous which have owner permissions and group permissions.
I have layouts that are changed by the owner - but I have users who are not the owners that need to change any and everything in the layout. In particular this person is over all of the digital signs and goes to them weekly and updates the layouts that they do not own. They have to change the duration field.
Are you saying that this can't be done even though the permissions are set - I see this as a bug.

The current version I'm running works fine - I cannnot upgrade to 1.4.1 at my largest site unless users who are not the owner can update everything on the layout.

Is there some way around this, so that a group memeber can change the duration field?

Would you consider fixing this for a fee?

Revision history for this message
Dan Garner (dangarner) said :
#8

The bug is fixed in 1.4.2 so that permissions are at least working as they were intended to in the specification. Regarding your other point - unfortunately there are people relying on it working exactly how it works at the moment - its a case of we cannot change it to suit you as that would break the existing functionality for others.

The correct way to do it is to have an option in the settings to define whether or not people with edit permissions also get to edit the duration on media items. This is new functionality and will need a blueprint to get implemented in the next version of Xibo.

We could patch it in your code (just for you) - contact us as <email address hidden> and we can discuss this - alternatively you could ask a company in the Xibo Directory to take care of it for you.

Thanks,
Dan

Can you help with this problem?

Provide an answer of your own, or ask David Coleman for more information if necessary.

To post a message you must log in.