Advanced Permissions
Advanced Permissions
Overview
Advanced Permissions replaces the basic view and edit controls of Simple Permissions with granular control over who can do what, on which pages, areas, blocks and files — and, optionally, when. Enabling it also makes Workflows available, which let you require approval before certain actions take effect.
Simple vs Advanced Permissions
| Simple Permissions | Advanced Permissions | |
|---|---|---|
| Page access | View and edit, set per page | Each action controlled separately — view, edit contents, edit properties, delete, move, approve versions, and more |
| Who you can target | Groups, and registered versus guest visitors | Individual users, groups, group sets, group combinations, and the page owner |
| Denying access | Not available | Entities can be explicitly excluded, overriding any inclusion |
| Scheduling | Not available | Any permission can be limited to a time window, optionally repeating |
| Scope | Pages | Pages, areas within pages, individual blocks, and files |
| Approval steps | Not available | Workflows can require sign-off before an action completes |
Before You Enable
Enabling Is Permanent
Once Advanced Permissions have been enabled on a site, you cannot revert to Simple Permissions. Advanced Permissions introduces changes to your site's database that cannot be undone.
Back up your database before enabling it. If you are not certain your site needs the additional control, enable it on a copy of your site first.
The admin Superuser Is Your Safety Net
Regardless of how permissions are set, the "admin" superuser will always have access to deleting, moving, changing permissions, and otherwise editing pages. If you lock yourself out of something, log in as admin and change the settings back.
Note that admin is the default account created when you set up your Concrete CMS site. It is a special user, not simply a user in your Administrators group — members of the Administrators group can be locked out, while admin cannot.
Create Your Groups First
Permissions are assigned to groups far more often than to individual users. Setting up the groups you intend to use at Dashboard > Members > Groups before you begin avoids reworking assignments later.
Enabling Advanced Permissions
Advanced Permissions is not enabled by default. To enable it, navigate to Dashboard > System & Settings > Permissions & Access > Advanced Permissions. Click Enable Advanced Permissions in the page that appears.
Common Tasks
| Goal | Where to look |
|---|---|
| See what governs a page right now | Viewing a Page's Permissions |
| Stop a page inheriting from its parent | Where a Page's Permissions Come From |
| Let one group edit a page | Adding and Removing Access |
| Block one person despite their group membership | Adding and Removing Access |
| Make a page public automatically at a set date and time | Timed Permissions |
| Apply one page's rules to another page | Copying Permissions |
| Limit which blocks an area accepts | Restricting Block Types in an Area |
| Show or hide a single block on a schedule | Block Permissions |
Viewing a Page's Permissions
To inspect a page's permissions, click the page settings (gear) icon and click Permissions. The same dialog is available from Dashboard > Sitemap by selecting a page and choosing Permissions.
The dialog has three parts:
- Assign Permissions — where this page's rules come from
- Subpage Permissions — what pages beneath this one inherit by default
- The permissions list — the individual actions you can control
Where a Page's Permissions Come From
The Assign Permissions selector defines the source of the page's rules.
By Area of Site (Hierarchy)
The page inherits the permissions set on the page above it.
The access entities from the page above are listed for reference, but the permission names appear as plain black text rather than links and cannot be edited here. To change access for this page, either edit the permissions on the page above, or set the page to assign permissions Manually.
From Page Type Defaults
The page uses the permissions set on its page type's Page Type Defaults.
As with hierarchy inheritance, these permissions cannot be edited directly from the page. To change them, edit the Page Type Default permissions, or set the page to assign permissions Manually.
Manually
The page carries its own permissions, independent of its parent and its page type. Each permission in the list is now rendered as a blue link, and clicking one lets you add access entities.
Choose this when a single page needs to differ from everything around it. Note that the page will no longer pick up later changes made to its parent.
Subpage Permissions
This selector sets how pages located below the current page will inherit permissions by default. New pages created below this level will inherit these permissions as well.
Inherit page type default permissions
Subpages inherit the default permissions specified by their selected page types.
Inherit the permissions of this page
Subpages inherit the permissions set on the current page.
Adding and Removing Access
Permissions may be edited by clicking on the name of the permission in the list, on any page set to assign permissions manually.
Access entities are the users, groups and combinations that a permission applies to.
Click the Add button to show the Add Access Entity dialog. To add an entity, click the Select dropdown menu and choose from Group, User, Group Set, Group Combination, or Page Owner.
Included and Excluded Entities
Each access entity is added under Included or Excluded, allowing or denying that entity access to the permission.
When inspecting a page's permissions, excluded access entities appear in red.
Exclusion Overrides Inclusion
Exclusion always wins. A user who belongs to an included group but is also excluded individually is denied.
This is how you carve out an exception without restructuring your groups. For example, granting View Versions to the Editors group while excluding the user "intern" denies that one account, even though it belongs to Editors.
Entity Types
Each type of entity can be included or excluded in a permission.
| Type | Applies to | Defined at |
|---|---|---|
| User | One specific account | Dashboard > Members |
| Group | Every member of a group | Dashboard > Members > Groups |
| Group Set | Members of any group in the set | Dashboard > Members > Group Sets |
| Group Combination | Only users who belong to all the listed groups | Selected when adding the entity |
| Page Owner | Whoever is currently set as the page's owner | Page settings |
User
These entities are the individual user accounts set up in your site.
Group
The permission is applied to a specific group of users, as defined at Dashboard > Members > Groups. It applies to all members of that group.
Group Set
Group Sets gather separate groups into a single entity, and are defined at Dashboard > Members > Group Sets. A user has access if they are a member of any group in the set.
Group Combination
Includes members of two or more groups who belong to all of the groups. For example, if Group A contains User 1, and Group B contains User 1 and User 2, only User 1 is included when Group A and Group B are used in a Group Combination.
Compare this with a Group Set of the same two groups, which would include both User 1 and User 2.
Page Owner
This applies the permission to the user currently set as the owner of the page. Because it is evaluated per page rather than fixed to an account, a single rule can grant each author control of their own pages.
Timed Permissions
The controls in the Time Settings section allow the selected permission to be valid only during a specified time frame. This is how you schedule a page to become publicly visible at a set moment, or restrict editing to certain hours.
To set a permission to apply for only a specific period of time, click the clock icon next to the access entity you've selected.
Then set the time period during which you'd like the permission to begin and end. Setting an end point is optional — leave it blank for a permission that starts at a given moment and continues indefinitely.
An access entity with a timed permission is listed in yellow on the page's permissions list. Mousing over it triggers a preview overlay showing the permission's time setting at a glance.
Repeating Schedules
Timed permissions can also be set to repeat the timed access setting every day, week or month. Select the Repeat box and choose the interval.
Examples
Make a page public at a set date and time. On the View Page permission, leave your reviewers' entity untimed and add the Guest group with a start date and time but no end date. Reviewers keep access throughout, and everyone else gains access at the appointed moment.
Prevent editing during a weekly maintenance window. On the Edit Page Contents permission, add the editing group to the Excluded list with a window from 1:00 AM to 2:00 AM, set to repeat every week. Those editors lose access for that hour each week.
Previewing Before It Takes Effect
Page settings include a preview control that lets you pick a future date and time and see what the page will look like then, so you can confirm a timed permission behaves as intended rather than waiting for the moment to arrive. The same control lets you preview the page as a specific user.
Copying Permissions
Copying One Permission to Another
Individual permission settings can be copied within the list by dragging one onto another. Mouse over a permission setting and a green "plus" icon will appear. Drag the permission onto another item in the list and release.
Copying All Permissions to Another Page
Permissions can also be copied and pasted from one page to another. At the end of the list of permissions items, locate the Copy button and click it to copy all the permissions for the current page.
Navigate to the page you want to apply the permissions to, view its permissions and go to the bottom of the list. You will now see a second button. Click Paste to apply all the permissions you copied from the first page to the current page.
Paste applies every permission from the source page, replacing what was there. Review the destination page's current settings before pasting.
Area Permissions
Permissions may be set for content areas in each page. These permissions include viewing the area, adding blocks and stacks, editing the design and layouts, and deleting content.
To set area permissions, click the Add to box below the area and choose Set Permissions. The interface for managing area permissions is the same as the page permissions interface, including Time Settings.
By default, area and block permissions are inherited from the page. Setting permissions on an area overrides that inheritance for that area only.
Restricting Block Types in an Area
You can use advanced permissions to restrict what blocks can be added to individual areas, and further refine those restrictions by group.
For example, if you have a header area that should only ever contain an image slider, you can set permissions on that area so the Editors group can add only the image slider block, while Administrators may add any block type.
- Click the page area tab you want to restrict and choose Permissions. Do this on the page in edit mode, or on the page type default if you want it applied to all pages of that page type.
- Override the current permissions and choose Add Blocks to Area.
- On the Detail tab, define by user group which block types may be added to that area.
Block Permissions
Block permissions function very similarly to area permissions, but include permissions such as viewing, editing, changing the template, deleting, and design.
To set block permissions, click the block and choose Set Permissions. As with area permissions, the interface is the same as the page permissions interface.
Scheduling Guest Access
Advanced Permissions includes a feature to schedule guest access for a particular block. This can show or hide a block to users in the Guest group, which includes unregistered anonymous visitors to your site.
To use this feature, click on the block, select Schedule Guest Access, and then specify a time range in which guests should be able to view the block.
The interface is similar to the one for setting timed permissions on pages. You are effectively creating a timed access entity for the Guest group on that block's view permission, through a simplified interface. To schedule access for any group other than Guest, use the full block permissions interface instead.
File Permissions
Enabling Advanced Permissions also changes the options available for file permissions. Each newly added file is governed initially by the global file permissions and by the permissions of any file sets it belongs to. Individual files and file sets can then be given their own permissions through the File Manager.
Troubleshooting
A permission appears as plain text and cannot be clicked. The page is inheriting its permissions. Change Assign Permissions to Manually, or edit the parent page or the page type defaults instead.
A user cannot access something despite belonging to a group that has been granted access. Check whether that user, or another group they belong to, appears in the Excluded list. Exclusion overrides inclusion.
A change made to a parent page did not reach its subpages. Confirm the subpages are set to By Area of Site (Hierarchy), and that the parent's Subpage Permissions setting is Inherit the permissions of this page.
You have locked yourself out of a page. Log in as the admin superuser and revise the settings.