Security Restrict not working for multiple permissions

[Elias]

Hi,
What is the expected behavior when setting multiple permissions under the Security Restrict component ?
Does the system authorize a user that have at least one of the permissions?
I had assumed so but it is not working as such,
Please advise
Elias

[Hyperbytes]

This is an old video but may help you with setting multiple permissions for users

Two table approach to user security permissions

As promised i have made a quick video on how to use a multi table approach to user security permissions and the benefits allowing a user to reside in multiple permission groups Sorry, video is a bit rough, when i get a chance i will produce a more polished version. Hope i have explained myself clearly Any questions/comment, please ask and if anyone can assist in the problem i highlight at then end i would be most appreciative!! (total length 7m40s) using-two-tables-for-permissions.mp4 (18.…

[Teodor]

Hi Elias,
How did you setup your multiple permissions and how do you check them?

[Elias]

Thank you but that was before they have allowed multiple groups under security restrict

[Elias]

Hi Teodor, i have set the permissions as per the wappler tutorial.

In Security restrict, if I have one permission or none, it works well

However, when I have 2 permissions neither permission 1 nor permission 2 works.

Can you please check?

[scott]

@Teodor, I see what @Elias is talking about.

If you set multiple groups on the security restrict, it will throw an error, but if one group or no groups are selected, it works just fine.

More than one group selected (with error):

Only one group selected (no error):

I think it has do with the user and permissions in the Security Provider. It might be that we are setting up our conditions wrong on our permissions, but I might be wrong on that.

For example, I have my public setting to include all levels of permissions, where my other permissions are a combination of different settings.

When I set the security restrict to public, I would assume that as an Administrator with a permission of “2”, I would be able to see the content. However, it throws a 403 Forbidden error when I try to view it.

When I set the security restrict to administrator, I am able to see it with no error.

[scott]

After going back and re-watching @Hyperbytes video, I added the additional permissions to my user and also changed the ‘=’ to an IN in the Security Provider and removed the additional conditions so each permission only has one condition.

So now my user has the permissions of Admin and Public as described in the video. I set the Security Restrict to the Public permission only and the content is displayed as it should be. This might help you out @Elias.

However, I now remember why I had an issue with this. Doing this broke other portions of my website, but I’ll post that in a different topic.

[Elias]

Thank you @scott, does it work now if you set multiple permissions under security restrict?

[scott]

Yes, I have all five of my permissions on the Security Restrict for my dashboard and it its retrieving my name to display on the page.

[Teodor]

@Elias and @scott
If you want to add multiple IDs to a permission you should use the IN operator with a comma separated list of values in the conditions list.