This site has been archived and you can no longer log in or post new messages. For up-to-date community resources please visit

eZ Community » Forums » General » Roles and Policies Newbie question

Roles and Policies Newbie question

Roles and Policies Newbie question

Thursday 21 April 2011 12:13:29 am - 9 replies

I'm a newbie to roles and policies. The project I'm working on requires that every registered reporter after login only sees his stories that he wrote in the folder My Stories. Let's say I have 20 reporters that after login only see their individual stories they created.

I created a user group Reporter with role Reporter with the following policies:

Reporter content read Class( Folder ) , Section( Standard )
Reporter content read Subtree( My Stories ) , Class( Story ) , Section( Standard ) , Owner( Self )
Reporter user login SiteAccess( eng ) Reporter user selfedit No limitations

I'm stuck since it doesn't work as expected. All the stories show on each reporters page even if I login in with a different reporter account.

Please help. Thanks.


Thursday 21 April 2011 7:17:09 am

Hi Uli,

Could you tell us more about the fetch function used to retrieve and display the children of the My Stories folder ? Any chance the 'limitation' parameter is used ? (feel free to paste the call to the fetch function here).


Thursday 21 April 2011 12:00:02 pm

Hi Nicolas,

thank you for your quick reply. I really appreciate it.

Actually I haven't touched the template yet regarding the fetch function. I assumed that I could control the content through roles and policies only.

I'm using ezPublish 4.2011 and created a user group "reporters" with policy setting "Content read Owner (self)". Also I use the standard user class to create reporter objects. I figured that just by using Owner (self) would display only the content that a user created. So whenever a user creates an article he is the owner, I guess. After login only those articles of this specific user should be shown.

What is the purpose of having Owner(self) if it doesn't list me only the objects related to a specific user?

If I have to use a fetch function how would that look like?

Thank you.


Thursday 21 April 2011 3:37:38 pm

Hm, maybe your users have some other role assigned that allows them to read articles.

For example they can have the Anonymous role assigned which can have the content/read/* policy. In that case every user would have access to all the articles regardless of any other new roless you assign.

Also, you should be clear about what you want to do:

  • a) restrict logged in users so that they can read only their articles and in no way to be able to read any other article
  • b) allow logged in users to read any article but have a special box in one part of the page where they can see only their articles

If yours is case a) then you should use the roles and policies to restrict it.

But if yours is case b) you should change the templates and use template fetch functions with attribute filtering. See here for the docs about template fetch functions:

Friday 22 April 2011 4:05:57 am

Hi Marko,

thanks for your reply.

Case a) is what I'd like to implement.

I created a Usergroup "Reporters" and a role "Reporters" with the following policies:

content create No limitations
content edit Owner( Self )
content read Owner( Self )
user login SiteAccess( eng )
user password No limitations
user selfedit No limitations
websitetoolbar all functions No limitations

After creating user1 and user2 I assign them to the usergroup Reporters with role Reporters.

After I login with user1 I created an article. After logout I logged in with user2 and the article shows also under user2. Anything I did wrong?



Friday 22 April 2011 8:22:46 am

Some things to check:

  • does the "Reporters" group have any other roles asigned
  • does the "Reporters" group belong to any other user group
  • when you look at your site as anonymous user (not logged in) can you see this article made by user1?
  • try disabling the cache on your site

Saturday 23 April 2011 4:40:54 am

Hi Marko,

thank you. Yes, it is the cache that causes the problem. Once it is disabled it seem to work now.

Thanks again.


Saturday 23 April 2011 11:17:31 am

Disabling cache is not a good solution, you should use ViewCacheTweak configuration setting and set it to pr_user.

By default the cache in eZP is not generated per user but you have the same cache for the users that have the same set of roles. This ViewCacheTweak settings allows you to have a per user cache.

The setting is not documented in the official eZ docs but you can find some info about it here:

and also take a look at the settings/site.ini and read the info below ViewCacheTweak.

Monday 25 April 2011 8:41:33 am

Thanks Marko. I'll check it out.


Tuesday 10 July 2012 3:38:31 pm

This forum post explains where to find the ViewCacheTweaks settings in site.ini/[ContentSettings]

And as Marko said, In the site.ini file, ViewCacheTweaks is documented to some degree.


You must be logged in to post messages in this topic!

36 542 Users on board!

Forums menu

Proudly Developed with from