Setting permissions

If you have 'permissions' (or 'admin') privilege, you can set the permissions on a directory using the 'Permissions' button in the ewok file manager (if there's no 'Permissions' button then you don't have sufficient privilege). This displays a list of privilege levels (see The ewok user model for an introduction) and a space- or comma-separated list of usernames for users who have been assigned the given privilege.

Permissions are inherited, which means that subdirectories by default use the permissions of their parent directory. This means that you generally define permissions at the top of a particular tree, and only need to modify them for sub-trees where the permissions change.

Note that because the 'view', 'edit', 'publish' and 'permissions' privileges are hierarchical, you do not need to add a user to more than one of these levels - simply assign them the most powerful privilege and they automatically get the others. The 'templates' privilege is not part of this hierarchy, so add templates separately if required.

ALL and NONE

The special tokens 'ALL' and 'NONE' are used to signify "all (valid) users" and "no users", respectively. To restrict access to a directory either use 'NONE' in the view permissions or use the list of read-only users to whom you wish to grant access. Setting a privilege level to NONE still permits users with higher privilege levels to access that directory, of course.

Multiple view privileges

There will usually be multiple view privileges defined. This is because ewok distinguishes 'view' privilege in the staging area ('view-stage') from 'view' privilege in publish directories (typically 'view-publ'). This allows you to set up more complex policies, such as having the staging area restricted but the published content public (like on an intranet, for example), or having the published content restricted but the staging area public (when publishing to an extranet, for example).

The publish-side view privilege is labelled 'view-publ' except in the case where a staging directory is configured to publish to multiple publishing targets. In that case the publish-side view privileges are labelled with the label used for the target: 'view-target1', 'view-target2', etc.