Difficult : Setting a Write Only permission on a node folder

[kroax]

Hi,

I managed to add a custom role in the list box on the user interface (in addition to "Consumer", "Contributor", etc.) when we invite a user in a space. This role is named : "WriteOnly". The problem is I don't managed to configure the .xml file permissionDefinitions.xml so as to associate a Write - Only - permission to the "WriteOnly" role.

My code is (which doesn't work) is :

<permissionGroup name="WriteOnly" expose="true"
         allowFullControl="false">
         <includePermissionGroup permissionGroup="AddChildren"
            type="sys:base" />
         <includePermissionGroup permissionGroup="Write"
            type="sys:base" />
      </permissionGroup>
<permissionSet type="cm:folder" expose="selected">

      <!– Content specific roles.                                                       –>

      <permissionGroup name="WriteOnly" extends="true" expose="true" />
      <!– The low level permission to control setting the owner of a node               –>
      <permission name="_WriteOnly" expose="false"
         requiresType="false">
         <grantedToGroup permissionGroup="WriteOnly" />
         <!– require to be able to reach the node and set properties in the node         –>
         <!–         Commented out parent permission check …–>
         <requiredPermission on="node" name="ReadContent"
            implies="true" />
      </permission>

   </permissionSet>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Thanks for your help.

[kroax]

I want that for a space : i.e a node of type folder (a container), that a group of users has write only acces privilege, the group can see the folder but can't see its content (its children). Then the group will be able to put document inside the folder (without having knowledge of what there is inside it)

Thanks for your participation

[kroax]

[seraphon]

Hi

I think the best solution to your problem is make a space where your users are normal contributors and put a rule that moves all files created in this space in a space where those contributors dont have the rights to enter.

But I may be wrong because I m a newb myself at Alfresco.

Regards
Seraphon

[kroax]

So I want more advice,

thanks for response anyway

[andy]

Hi

I think you just want a modified version of the contributor role without the read permissions. You still need to be able to read the parent folder and disconnet read from all children (do not inherit parent permissions).

At some point we will add inheritable and non inheritable permissions to make this easier.

Andy

[sbs_tcr]

Hi,

First of all, thanks to Seraphon and Andy in guiding me to a quick and dirty solution.

I am using Alfresco 3.0. I have the same requirement. Tried having a move rule from a space where the normal users are contributors to a space where they have no rights. But even that it did not work. When I tried a simple workflow instead of the move rule, the reason was clear. I got an error message saying that I don't have enough access rights. Eventually I solved it by editing the contributor role and removing consumer and read access from that. Can someone tell me how to add a new role and make it appear in the roles when we invite a new user to a space?

Thanks
sbs

[caesar]

Yes I can,


Be sure that [ permissionDefinitions.xml ] file contains in cm:folder the new role, otherwise you dont see it in de GUI


    <permissionSet type="cm:folder" expose="selected">

          <permissionGroup name="WriteOnly" extends="true" expose="true" />

     </permissionSet>

Bye

[fuad_gafarov]

1. Open file - <ALFRESCO_HOME>/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/model/permissionDefinitions.xml

2. Add to end of code

           <!– Kept for backward compatibility - the administrator permission has   –>
          <!– been removed to aviod confusion –>
          <permissionGroup name="Administrator" allowFullControl="true" expose="false" />
         
          <!– A coordinator can do anything to the object or its childeren unless the     –>
          <!– permissions are set not to inherit or permission is denied.                 –>
          <permissionGroup name="Coordinator" allowFullControl="true" expose="true" />
         
          <!– A collaborator can do anything that an editor and a contributor can do –>
          <permissionGroup name="Collaborator" allowFullControl="false" expose="true">
             <includePermissionGroup permissionGroup="Editor" type="cm:cmobject" />
             <includePermissionGroup permissionGroup="Contributor" type="cm:cmobject" />
          </permissionGroup>
         
          <!– A contributor can create content and then they have full permission on what –>
          <!– they have created - via the permissions assigned to the owner.              –>
          <permissionGroup name="Contributor" allowFullControl="false" expose="true" >
              <!– Contributor is a consumer who can add content, and then can modify via the –>
              <!– owner permissions.                                                      –>
              <includePermissionGroup permissionGroup="Consumer" type="cm:cmobject"/>
              <includePermissionGroup permissionGroup="AddChildren" type="sys:base"/>
              <includePermissionGroup permissionGroup="ReadPermissions" type="sys:base" />
          </permissionGroup>
         
          <!– An editor can read and write to the object; they can not create    –>
          <!– new nodes. They can check out content into a space to which they have       –>
          <!– create permission.                                                          –>
          <permissionGroup name="Editor"  expose="true" allowFullControl="false" >
              <includePermissionGroup type="cm:cmobject" permissionGroup="Consumer"/>
              <includePermissionGroup type="sys:base" permissionGroup="Write"/>
              <includePermissionGroup type="cm:lockable" permissionGroup="CheckOut"/>
              <includePermissionGroup type="sys:base" permissionGroup="ReadPermissions"/>
          </permissionGroup>
         
          <!– The Consumer permission allows read to everything by default.                  –>
          <permissionGroup name="Consumer" allowFullControl="false" expose="true" >
              <includePermissionGroup permissionGroup="Read" type="sys:base" />
          </permissionGroup>


          <permissionGroup name="WriteOnly" allowFullControl="false" expose="true" >
                  <includePermissionGroup permissionGroup="Write" type="sys:base" />
        <includePermissionGroup permissionGroup="AddChildren" type="sys:base"/>
          </permissionGroup>

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

and

       <permissionSet type="cm:content" expose="selected">

          <!– Content specific roles.                                                       –>
         
          <permissionGroup name="Coordinator" extends="true" expose="true"/>
          <permissionGroup name="Collaborator" extends="true" expose="true"/>
          <permissionGroup name="Contributor" extends="true" expose="true"/>
          <permissionGroup name="Editor" extends="true" expose="true"/>
          <permissionGroup name="Consumer" extends="true" expose="true"/>
          <permissionGroup name="RecordAdministrator" extends="true" expose="false"/>
          <permissionGroup name="WriteOnly" extends="true" expose="true"/>   
       </permissionSet>

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Restart Alfresco.
It create new Role called WriteOnly. User not see folder but write by script.