YOOtheme Pro is here! The best WordPress and Joomla theme. Learn more

Avatar john.griffiths asked

Yootheme Pro ACL issues

We have built a client site using Yootheme Pro, however have encountered a major issue when it comes to the ACL.

We had planned on allowing access to certain pages/articles on the site, but not others (Home page for instance); however any user with access to the administration interface has access to the Builder - allowing them to effectively has almost full reign over the site, pages, template and styles.

From inside the builder, even with very restricted permissions, the user can use the on page navigation to get to any page of the site and make changes - regardless of the permissions set within Joomla.

The homepage for instance, I have restricted access through Joomla but clicking "Website builder" within the Control Panel dashboard takes them directly to the homepage and gives the user full access to the builder and styles. The only thing the Builder appears to adhere to is the module permissions; but the user can still remove any of these as they please.

Unfortunately this is massively delaying our handover and so any assistance with this would be appreciated.

  • Joomla
  • Feature Request
  • YOOtheme Pro

4 Answers

1

Avatar hendrik Yootheme answered

Hi,

sorry for the delay!
We will look into this.

UPDATE
The current version 1.5.6 has fixed ACL issues in Joomla. Users with only access to articles will only see the page builder when clicking the page builder button. They can not modify template settings anymore. Also, they can only edit articles which they have access to.

Regards

Edited

1

Avatar josh.terrell answered

On top of this, if the user has access to the customizer, they also have plain text access to your yootheme api key among other things.. The average end user should probably not have access to add/edit CSS or add custom javascript, etc.

0

Avatar john.griffiths answered

It's been over three weeks now and not a single response...

Know someone who can answer? Share a link to this question via email or twitter.