Settings of this group in the settings files of Exponential 6.0.15 that this page does not describe:
| Setting
| File
| Default
| Description
|
| PoliciesPerPage
|
settings/site.ini
|
25
|
How many policies a screen shows at once. A role's policy list is paged. $role.policies is every policy the role has, which the permission system needs and a screen does not: on an installation whose roles carry policies in the millions, loading them all to draw a screenful exhausts memory before the first row is written.
|
| AccessArrayPrefetch
|
settings/site.ini
|
enabled
|
How the access array of a user is built when the role cache is rebuilt. enabled loads the policies, limitations and values of all the user's roles in three queries and computes the limitations of a policy once for all the assignments of its role (a member of 120 teamrooms has every policy of the member role 120 times). disabled asks the database once for every role, policy and limitation, as before. The access array is the same either way, in the same order.
|
| PreventPrivilegeEscalation
|
settings/site.ini
|
enabled
|
Whether a user who may edit roles can give more than they have themselves. enabled (the default) refuses, in the role editor, the policy wizard, the policy editor, role/copy and role/assign, any policy or assignment that is broader than the editor's own access: a policy must be covered by one of the editor's policies (module, function and every limitation of that policy, a subtree inside one of its subtrees, sections, classes, nodes, languages and other values among its values), and a role may only be assigned when the editor covers every policy of it, narrowed by the assignment's limitation. Users with access to every function of every module may grant anything. disabled gives back the old behaviour: role editors may grant anything.
|
| AssignmentsPerPage
|
settings/site.ini
|
50
|
How many of the users and user groups a role is assigned to role/view shows at once, sorted by name and paged on (assignment_offset). A role given to thousands of users took long to draw. 0 lists all of them on one page.
|
| RolesPerPageList
|
settings/site.ini
|
10; 25; 50
|
The page sizes the role list offers in its items per page selector. The stored preference is the position in this list, counting from one, so a site that changes these keeps everyone's choice rather than resetting it - and the old 1, 2 and 3 still mean the first, second and third entry.
|
| PolicyPreviewPerRole
|
settings/site.ini
|
10
|
How many of a role's policies the summary window on a user or user group shows before it stops and links to the role. That window lists every role the user has, so it is the product of two lists rather than one.
|
| PermissionSQLOptimization
|
settings/site.ini
|
enabled
|
How the permission condition of a content fetch is built from the read policies of the user. enabled merges the policies that differ only in the subtree their role is assigned for (a member of 120 teamrooms has every read policy of the member role 120 times) and leaves out those that cannot give access to a node the fetch returns: subtrees outside the fetched one, classes outside its class filter. The fetch returns the same nodes. disabled ORs every policy as before; SQLite refuses that condition from 1000 policies on.
|
| PolicyOmitListExclude
|
settings/site.ini
|
(empty)
|
Entries taken out of PolicyOmitList[] after every settings file is merged, so a site can close one entry without resetting the list (a reset would also drop the entries the active extensions add). New installations write PolicyOmitListExclude[]=user/register in settings/override/site.ini.append.php: registering then needs the user/register policy, which their Anonymous role has (remove it there to close registration), and the login pages show the "register" link only to a user who has it. An upgraded site keeps user/register open; to close it, add the line above to settings/override/site.ini.append.php.
|
| LimitationHandlers
|
settings/site.ini
|
(empty)
|
Handlers of content policy limitations the kernel does not know itself, one class per limitation name; the class implements ezpContentLimitationHandler. An extension that adds a limitation to a content function (event filter module/functionlist) registers its handler here. A limitation without a handler denies: in checkAccess() and in the SQL of list and tree fetches. LimitationHandlers[MyLimitation]=myLimitationHandler
|
Comments
Add a comment