Internal Server Error after removing Everyone permission from Repository Sites folder

[gerryr]

When I remove the inherited Everyone permission to Repository Sites folder then Users without administrative permissions start seeing Internal Server Error.  And there are Access Denied errors in the log to web scripts.  We set local permissions on the Sites folder just for the Site managers and administrators.

So how are we supposed to limit visibility to Sites?

We cannot just have every user be able to list out all the Sites.

Some users do not have the authorization to be able to know about or view these sites.

A site should only be visible to those users who have been invited to become members of the Site.

[niketapatel]

Hi Gerry,

I believe you are managing site permission from Alfresco explorer that is not advisable.

From your post, it looks like users are accessing sites folder from explorer too and you dont want them to access.

1)To hide sites folder from end-users who are not invited, You can create site with "Private visibility".
non-admin user can not see private site folder from explorer/repository view and they also can not search from Share UI.

2)Other options is create site with Public and Moderated membership so non-admin user can see only site folder from explorer/repository view not anything inside that site folder and from share UI they can only search site and request to join that site.

Hope it helps!

[gerryr]

Hi Niketa,

Yes, we are using your option 2.  Public but Moderated. 

But maybe Private is what we need because we cannot allow non-admin users to even see the site in a listing. 

I was expecting Moderated to make the site visible only to invitees but it's not working that way.

[gerryr]

Even Private is not working totally.

I create a new Site as Private.  The site then will not show up in listings.

But if I change an existing Site property from MODERATED to PRIVATE:

As a non-member user I can go to the Site Search and it will list the Private site.  I can go to the Repository Sites and it will also list the Private Site to non-members.

We need for all Private Sites to be totally invisible to non-members.

Opened bug:  https://issues.alfresco.com/jira/browse/ALF-20784

[niketapatel]

Changing site visibility to private from public/moderated is working for me. I am using 4.2EE, might be bug in 4.2e

[gerryr]

Niketa, yes you can change it.  I was able to change it.

But when you go and check the visibility you find that it is not private.

[gerryr]

Andy, please do not mark the bug as resolved unless the Reporter agrees that it is resolved.

https://issues.alfresco.com/jira/browse/ALF-20784

The bug is not resolved.

Andy, your UserB can still see the listing of the site in Repository Sites.  The site is not truly private.

[aseer]

just add your all users or group of users to sites folder in Repository " Login as a administrator click Repository –> Sites –> Manage Permissions –> Add User/Group –> user or group name –> search –> add –> give permission and save and done 😘