Several user groups and separate access

Hi, I want to create a few user groups in CMS with separate accesses (to resources and files). In other words, I want each group to be able to see different resources in CMS and different files in media source after logging in.

Currently, I have two users (user1 and user2) assigned to two user groups (beneficiary 1 and beneficiary 2). Each user group has a separate Resource Groups and Media Source. After logging in, each user sees different resources and has a different file repository. For example, user1 sees in Resources Folder beneficiary 1 and in Files he sees the folder ms1.

The problem starts when the image TV is set in the resource, because Media Sources for two sources (ms1 and ms2) cannot be set in TV. And all groups will use the same templates and the same template variables. Currently, if I don’t set any Source to TV (image) in Media Source, you can’t see the field to select an image at all. And if I select Source ms1 then only user1 sees it, but user2 does not. How to do this correctly?

I’m not sure if what you’re trying to do is possible.

An image TV saves the path of the image file relative to the base-url of the media source. An image TV can only have one media-source, because otherwise the file path would be ambiguous.


Maybe you could try something that is similar to this solution for resource-specific media sources in MIGX. Here a snippet is used in the settings for basePath and baseUrl of the media-source. That makes the path of the media-source dynamic, based on the resource-ID. Something similar could be achieved by using the template-ID or maybe the ID of the parent resource.

I believe that there must be a way. If you can make a separate Resource and a separate Media Source then it must be possible to use these separate files on TV. Otherwise, why create separate Media Source if you can’t use them on TV?

I’ve never tried this, but I think you could put the TVs in different categories and use an Element Category Access ACL entry to protect them.

@halftrainedharry @bobray

So far I managed to achieve the desired goal but in a very inefficient way. Namely, for each user (group of users) I created a separate TV (photo) with separate access to Media Source and with separate Access Permissions (visibility) in the template. Now each user can see in the template they will change the TV named Photo and have access to their photos in Media Source. But this solution forces the creation of very many of the same TV to one template. If I want to have 5 TVs in one template with access to Media Source so that 20 user groups can manage it, I will have to create as many as 100 TVs! These are absurd solutions but so far the only one I’ve been able to do.

Does anyone have any more ideas?

Is the site in MODX 2.x, or 3.x?

The site is under construction and I am using the latest version of MODX 3.x

I’m afraid I don’t really understand your use case, with respect to media sources and TVs.

My only thought is that you might be able to use NewsPublisher in the front end by configuring its elFinder browser, which allows you to assign multiple browser roots. In other words, users will be able to browse in and under more than one directory.

See the “Configuring elFinder” section here.

I had an idea, but it didn’t work out. If MODX assigned IDs to the folders in the media browser file tree, this would be easy.

Hi, I’m back again with a question as I still haven’t managed to solve this in a meaningful way. Let me try another example. Let’s say we want to create a newspaper page that has three sections: sports (4 editors), culture (3 editors), nature (2 editors).

I would like to make a division in the CMS such that if a sports editor logs in, he sees ONLY the resource tree (sports articles) and has access ONLY to resources added by sports editors. Similarly for the other sections. How do I do this?

  1. Add the sports pages to a “Sports” Resource Group.
  2. Add the sports editors to a “SportEditors” User Group.
  3. Connect the Sports Resource Group to the SportsEditors User Group with a Resource Group Access ACL entry with a Context of mgr.
  4. Do the same for the other pages and groups.

The above assumes that you’re letting the users log into the Manager (for that you may need a Context Access ACL entry with a context of mgr for them).

If you would rather keep the users out of the Manager, you can let them edit the pages in the front end, after logging in, with the NewsPublisher extra.

Hi, I’ve revisited this project and everything you’ve written is OK but there is a problem in TC as I wrote about at the very beginning of the thread. If we set theTV variable “photo_article” in the template “article” which all sections use (sport, culture, nature ) it has to have a source given.

And if we give “Filesystem” then all sections can see files (including other sections). And if I select only source_sport (which belongs to ACL > Sport )

then only the Sport section can use the TV in question, the others cannot select the photo.

I would also add that in TV “photo_article” Access Permissions is allocated to all groups:

I’m not sure I understand you, but would it work to restrict the TV itself rather than the Media Source? You can control access to the TV with Element Category ACL entries.

Hi, I already did something like this and described on January 22 (will see above). But this is not an effective way because for each group you need to create a different TV (e.g.: photo_sport, photo_culture, photo_nature).

Sorry, I forgot that.

How about one text TV with a comma-separated list of allowed groups and a custom snippet to hide the Photo TV from groups without access?

I don’t really understand how it would work using text TV. Can you dissect your idea? Generally each user group (sports, culture, nature) should create resources based on the same template and using the same TV, the only thing is TV access to media.

When you use a normal TV of “Input Type” = Image, the image path that is stored as the TV value is relative to the path of the media source.
The TV values are stored in the database table modx_site_tmplvar_contentvalues (column “value”).

The selected media source is stored in the database table modx_media_sources_elements. This value is the same for all the TV values (in the same context).

For the output (of the complete image path), the path of the media source is then combined with the TV value.

If you would add multiple different values to modx_media_sources_elements, how would MODX know which one to use for the output of a specific TV value?


The only way I see, to do something like you want (besides a dynamic media source path which I mentioned in my previous post), would be to create a Custom TV Input Type.

In this custom type you would save both the image path and the media source ID in the TV value (for example as JSON). Then for the output, you could create the correct complete path from both these values in a snippet.

But creating a custom TV type isn’t easy and requires deeper knowledge of Ext.js and MODX. So it’s probably not worth the effort.

Hi, dynamic media source path seems to be a good solution just how to do it. I imagine that then there is a folder ID from the parent eg:

I see what you mean. I think it might be possible with three TVS, each connected to a separate media source.

A custom snippet could check the user’s group membership, and then return a tag for the appropriate one of the three TVs.