Hi Kevin,

I'm testing your plugin for the use in an wordpress intranet (Wordpress 3, PHP 5.2.6, Role Scoper 1.2.5).

I can't manage to restrict the editing capablities to subpages of specific pages.

WP role is set to Subscriber,  general role of the group is set to Post + Page Author, and for the Page Role "Associate" is activated for the higher-level page and "Page Editor" for the sub-pages.

The user can edit already existing pages, but he can't publish new ones, because there are no entries in the Parent drop down except for "Main Page". So no parent can be selected. When "Published" is clicked, an error message is displayed: "… cannot be published because you do not have permission to associate it with the Main Page. Please select a different Page Parent and try again."

When I set the general role of the User/Group to Editor, they can publish, but they are no longer restricted to specfic sub-pages.

Please see these images:

http://bitfresh.com/info/user_vorstand.gif

http://bitfresh.com/info/associate-Main-Page-problem.gif

-Andrea

Thank you Kevin for this version. This helped to get the editing side right.

But now page restrictions are no longer valued. Even a user (WP-Subscriber, RS-Reader) sees all pages although some pages are restricted to "page editor".

I'm not sure whether this is a bug or I simply lost my way while diving through the different Role Scoper options and check boxes.

Might be best, when I start a new test blog with a fresh Role Scoper install. Of course I would like to do it right this time. Could you tell me how to set up the following:

- three user groups: A, B, C

- pages/categories (incl. sub-pages and sub-catgories): A, B, C

Display/View:

- A should see only A pages/categories.

- B should see A and B pages/categories.

- C should see A, B and C pages/categories.

Edit/new Pages:

- A: no edit capabilites

- B can edit only A and B pages/categories, incl. sub-pages and sub-categories.

- C can edit A, B, and C pages/categories, incl. sub-pages and sub-categories; but no higher level pages or categories.

Thank you,

Andrea

Thanks for the step by step descriptions. The view/display part works as it should. Also the edit post part works. But not publishing of new pages.

But C and B user groups which are granted Page Editors rights for the pages and are associated with the top level pages cannot publish new pages. After clicking the "Add new" button the browser displays following message:

"Thank you for creating with WordPress. | Documentation | Feedback

Version 3.0″

But B and C users can edit existing pages.

When I assign the general role of "page author" to their groups they can publish pages, but then the display restrictions do not work. With this constellation B sees not only the content of A and B, but also the content of C.

I've gone several times through the procedure of setting up the rights and restrictions following your instructions, but can't get the right results. Either users can't publish new pages or they can see all.

-Andrea

One other observation: B and C users don't see the links to the parent pages in the sidebar of the blog.

Kevin said:

The error there is that the "Add New" link is present at all

This error (for users who have an object-specific editing role but lack the site-wide role required for object creation) only occurs with WP 3.0. I've just updated the development version with a fix.

Boa said:

I have not changed the RS-Role definitions from the defaults.

But it is still not working correctly. With the new version that you have posted above I have used the following settings:

—

WP-users: all default to Subscriber

Role/Options: All Posts/Pages to private; Roles and Restrictions can be set "by User Administrators only"

Role/General: B- and C-Groups to Post/Page "Author"

Categories/Page Restrictions:  A-pages/categories set to "Reader"; for B- and C-pages/categories set to "Editor"

Role/Pages and Role/Categories: A is Reader for A-pages/categories incl. sub-pages; B is Editor for A- and B-pages incl. the sub-pages (categories/sub-categories); C is Editor for A-, B- and C-pages incl. the sub-pages (categories/sub-categories).

—

Result:

For every new page that a member of the C-group creates under the C- page  Role Scoper itself (not me changing settings) sets the role of that page to "Editor" for both B and C-groups. Therefore B can see and edit that page and add new pages under that page (which they shouldn't by the original settings.

Actually, that behavior is by design. "page and subpages" means both existing and future subpages. If you only want them to have the Page Editor role for existing subpages, don't use the "and subpages" assignment. Instead, just assign the Page Editor role directly for each desired subpage.

Boa said:

Posts of C in category C are correctly hidden from B, but  B can publish posts in C-categories (and see these posts) which shouldn't be the case.

This statement makes me think your Restriction settings do fit your intended behavior:

A-pages/categories set to "Reader"; for B- and C-pages/categories set to "Editor"

Restrictions do not work by setting a page/category "to Reader" or "to Editor". You need to restrict each role which, in that category or page, should not be honored based on assignment in a broader scope. Since the Author roles also "contain" the capabilities of the Contributor roles, you need to restrict Post Author, Post Contributor, Page Author, Page Contributor to prevent the General Role assignments from making those categories editable / submittable.

Page Editor / Post Editor does not necessarily need to be restricted because your users do not have its capabilities via a WP Role or General Role.

Okay, I misunderstood your results.

You are correct that auto-assignment of a role to group C despite no propagating "for subpages" settings is not by design. Since I'm not able to trigger this error on my own installation, I have emailed you about getting me some diagnostic access to review your settings and make sure nothing is being overlooked.