Share
ReportHello,
I have created a web page called 'Create new order' and 3 web roles:
admin, authorized user, anonymous user (as default).
What I want to achieve is: block the page for anonymous users, accessable for authorized user, and allow front-end publishing including editting chile page, web contents..... for admin.
I have set up 2 web page access rules,
1. 'Restrict access for creating new order' which sets 'restrict read' and attached anonymous user web role on it,
2. 'Allow access to authorized user' where sets 'grant changes' and attached authorized user web role on it.
In the 'create new order' template I set up a secutiry control like this:
{% assign is_admin = user | role: 'admin' %}
{% if is_admin %}
User is admin
{% include 'entity_list' key: 'A List for admin' %}
{% else %}
User is not admin
{% include 'entity_list' key: 'B List for end users' %}
{% endif %}
Though when I look at the portal and login as authorized user, I see it work out as an admin where it can do all front-end edit and webpage shows up B list,
so I think the system recognize it as an admin.
Is there anything I am missing as I'm very new to web security control on portal?
Thank you very much,
Best Regards,
*This post is locked for comments
All responses (
Answers (
291,269
