topic Re: Temporary hide documents in Alfresco Archive

Temporary hide documents

jpfi — Tue, 08 Oct 2013 08:26:57 GMT

Hi folks,I'd like to achieve the following behaviour:- Temporary hide documents for all users that only have read-permissions on the documents - user with at least write perms should still be able to access the document.- The documents should be hidden independent from the way accessing (Share, WebD

Re: Temporary hide documents

cleseach — Tue, 08 Oct 2013 09:28:11 GMT

Hi Jan,

Not sure it's a possible solution, but there is a "sys:hidden" aspect :


<!– aspect to tag hidden nodes –>
      <aspect name="sys:hidden">
         <title>Hidden</title>
         <!– Explicitly turn off archiving for all nodes with this aspect –>
         <archive>false</archive>
         <properties>
             <!– A bit mask encoding whether clients (such as CIFS, WebDav, Share, …) can see the node –>
            <property name="sys:clientVisibilityMask">
               <type>d:int</type>
               <mandatory>false</mandatory>
               <default>0</default>
            </property>
         </properties>
      </aspect>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Let me know if it fits your needs.

Best regards,
Charles Le Seac'h

Re: Temporary hide documents

jpfi — Tue, 08 Oct 2013 11:30:24 GMT

Hi Charles,
thx for your reply. using such an aspect would do the job if I'd like to hide the document for all users.
I would like to hide the document for all users that normally would have read permissions - all users having at least write permissions should still be able to access the document.
Cheers, Jan

Re: Temporary hide documents

tommorris — Tue, 08 Oct 2013 12:23:05 GMT

Hi Jan,
Sorry - I didn't quite understand your comment:
"e.g. if the ACL on the parent folder was modified & the private permissions of a hidden document must be updated also.".
So what if the ACL changes on the parent folder? You've broken inheritance, so you still keep the document's specific permissions.

Re: Temporary hide documents

jpfi — Tue, 08 Oct 2013 14:13:00 GMT

Hi tom,

let's take the following scenario:

Folder A
|
- Document X

Folder A has a typical Share-Site ACL like & Document X inherits permissions:
Group_SiteABC_SiteConsumer = SiteConsumer ALLOWED
Group_SiteABC_SiteCollaborator = SiteCollaborator ALLOWED
Group_SiteABC_SiteManager = SiteManager ALLOWED
….

Now, i'd like to hide Document X for all Consumers, so I disable the inheritance for document X & document X has the following ACL
(Group_SiteABC_SiteConsumer = NONE)
Group_SiteABC_SiteCollaborator = SiteCollaborator ALLOWED
Group_SiteABC_SiteManager = SiteManager ALLOWED
….

but, if now someone updates the permissions of Folder A - e.g. Group_SiteABC_SiteCollaborator=SiteConsumer ALLOWED, then I've to update the ACL of document X also to (but there is no ~onACLUpdateBehaviour):
(Group_SiteABC_SiteConsumer = NONE)
(Group_SiteABC_SiteCollaborator = NONE)
Group_SiteABC_SiteManager = SiteManager ALLOWED

If I could use denied-permissions then I could still inherit permissions. in our last example document X would have the following ACL:
Group_SiteABC_SiteConsumer = SiteConsumer ALLOWED (inherited)
Group_SiteABC_SiteCollaborator = SiteConsumer ALLOWED (inherited)
Group_SiteABC_SiteManager = SiteManager ALLOWED (inherited)
Group_SiteABC_SiteConsumer = SiteConsumer DENIED
Group_SiteABC_SiteCollaborator = SiteConsumer DENIED

Cheers, jan

Re: Temporary hide documents

tommorris — Tue, 15 Oct 2013 18:42:19 GMT

Oh I see! Yes that is a tricky.

I think what you're saying is:
1) You've denied the consumers-group access on a particular document.
2) Then you subsequently decide that the collaborators-group should also not have access.
3) …but not just denied for that one document, but for all documents in that folder.
4) …however since permission inheritance is broken, that single document still remains visible to the collaborators group.

Yes, we too normally use the very useful, (but not widely known) 'deny-permissions'. But we've yet to do this on a v4/Solr installation, so were not aware that Solr doesn't respect them (thanks for the info).

Does the search result set generate a permissions error when trying to generate the HTML/JSON rendition?

Have you raised a Jira defect for this?