CODEWITHSUNDEEP
typo3typo3-7.6.xaccess-rights
Kendel Ventonda
Kendel Ventonda

Reputation: 411

Typo3 user rights are inherited incorrectly

I am trying to create user rights in Typo3 7.6 so that a user can simply work as an editor. He has, for his department, a section of the page tree. In that he can almost exclusively create text & media. For a single subpage of this whole tree, it also requires the ability to create an HTML element.

From my personal logic, it would be sufficient to create a user group (A), with all the usual rights would be covered. So creating pages, texts and media. A second user group (B) then only with the explicit permission to create HTML elements. Under Access, I have selected the group in the entire page tree as a simple editor (A), under which one page may be on the HTML, but the second user group (B).

But now it seems that as soon as the user receives the group B, it is not only allowed to create HTML for the one page, but the entire page tree. What am I doing wrong? How is that otherwise thought?

Upvotes: 0

Views: 93

Answers (1)

Georg Ringer
Georg Ringer

Reputation: 7939

This doesn't work this way. The permissions of all groups are combined and are the same on any page.

A possible solution could be to use the extension content_defender and a different backend layout for those pages where the HTML element is allowed.

Just as a side note: Allowing an editor the HTML element is a security risk as the editor can also create JavaScript and with that can get admin permissions and other stuff. So I would be very careful with that and would avoid allowing this element for admins.

Upvotes: 2

Related Questions