How to hide "Extensions" menu in admin panel?

[jordanlev]

Hi. I would like to set up CMS Made Simple for a client, but I only want them to be able to administer "News" items. I purposely want to remove as much as possible from the admin panel for the client because they are not very computer savvy and any extra things to click on and look at will only confuse them. So, I have removed all permissions except "Modify News" from the Editors group, and when a user in the Editors group logs in to the Admin panel, ALMOST everything I don't want them to see is hidden (which is great). The only exception is the "Extensions" block is still showing up (in the menu and on the 'main' listing page) with the sub-items "Tags", "Events", and "Search"

I looked at the php code, and found something in the "SetAggregatePermissions()" function of the "lib/classes/class.admintheme.inc.php" file:

Code: Select all

$this->perms['extensionsPerms'] = $this->perms['codeBlockPerms'] |
    $this->perms['modulePerms'] |
    (isset($this->sectionCount['extensions']) && $this->sectionCount['extensions'] > 0);

It appears that although the user doesn't have 'codeBlockPerms' or 'modulePerms', this is getting overridden by the fact that $this->sectionCount['extensions'] is greater than 0.
I can of course make an ugly hack to this code to "fix" this, but I do not understand the overall implications. Why is it that if sectionCount is greater than 0 that the block is shown anyway? Perhaps the problem is that the "Tags", "Events", and "Search" extensions don't have their own permission settings -- so if somehow permission settings for these extensions were added to the admin panel (so I could check or uncheck them), then the code would do as I like?

Any guidance on this issue would be greatly appreciated. Thanks alot!

   -Jordan Lev
     Portland, Oregon, USA

[jordanlev]

Well, I figured out how to "fix" this issue. You must make the following change in the "VisibleToAdminUser()" function of the CMSROOT/modules/Search/Search.module.php file:
replace the "return true;" line with:

Code: Select all

return $this->CheckPermission('Modify Modules');

This "ties" the visibility of the Search module in the admin panel to the "Modify Modules" permissions setting (which made more sense to me than any other permissions setting). This then has the desired effect I was looking for (the "Extensions" menu item does not appear if the user's group does not have the "Modify Modules" permission).
I am unsure why only the "Search" sub-item of the "Extensions" menu needs to be changed in order to achieve my goal -- the "Tags" and "Events" sub-items are not modules so I don't understand how they interact with the admin panel. Does anyone know how this works? Thanks.

  -Jordan Lev
    Portland, Oregon, USA

[jameshontishar]

Hi


How did you manage to lock this down in the first place.

I am trying to do the same thing but am a novice  please advise


Thanks

[Ted]

That was an oversight by me.  I didn't add a permission for the Search module for some stupid reason.  So it's always returning true.  I'll make sure I get that into my next release of Search.

[casidougal]

jordanlev,

Thanks for the fix and keeping the "simple" in CMSMS...I had the exact same reason for wanting to make this option go away for my most basic non-technical client.

I notice that this issue persists even with 1.0.4 . . . . a very insignificant price to pay for such an great CMS application though.

[casidougal]

Note: Adding the form builder module will cause the “extensions” field to appear again in any user's admin panel. If this module is installed, add the following line to modules/FormBuilder/formbuilder.module.php (note: you still need to modify search.module.php as instructed earlier in this thread):

I don't think it matters where this code is added but it works for me when added immediately following the content of the “function initialize()” lines:



function VisibleToAdminUser()
  {
    return $this->CheckPermission('Modify Modules');
  }

[liquid]

That was an oversight by me.  I didn't add a permission for the Search module for some stupid reason.  So it's always returning true.  I'll make sure I get that into my next release of Search.

Not to bring up old dead threads, but is there a reason why this bug is still in the search module? I have to keep fixing it with every release.

[generic]

in class.admintheme.inc.php

around line 775 change the permission of the extensions to something else you would want it to be allowed under like managing users as i did inthe example

Code: Select all

'description'=>lang('extensionsdescription'),'show_in_menu'=>$this->HasPerm('extensionsPerms')),

change it to for example:

Code: Select all

'description'=>lang('extensionsdescription'),'show_in_menu'=>$this->HasPerm('userPerms')),

which will now only show the extensions menu if the user has permission to manage users.