Limitations are crucial building blocks of the permissions system in eZ Platform. They provide the res= trictions you can apply to a given access right to limit the right accordin= g to certain conditions.
Limitations consist of two parts:
Limitation (Value)LimitationTypeCertain limitations also serve as RoleLimitations, which means they can =
be used to limit the rights of a Role assignment. Currently this covers Section limitations.
Limitation represents the value, while LimitationType=
deals with the business logic surrounding how it actually works and=
is enforced.
LimitationTypes have two modes of operation =
in regards to permission logic (see eZ\Publish\SPI\Limitation\Ty=
pe interface for more info):
| Method | Use |
|---|---|
evaluate |
Evaluating if the user has access to a giv=
en object in a certain context (for instance the context can be Locations w=
hen the object is Content), under the condition of the L=
imitation value(s). |
getCriterion |
Generates a Criterion using <=
code>Limitation value and current user which SearchService by default applies to search criteria for filtering search based on per=
missions. |
| Limitation | Description |
|---|---|
| BlockingLimitation | Generic limitation that always tel= ls the permissions system that the user has no access, causing it to contin= ue to the next policy. |
| Limits content access depending on its Con= tent Type. | |
| Limits content access depending on its Lan= guage. | |
| Limits content access depending on its Loc= ation. | |
| NewObjectStateLimitation | Limits content ObjectState a= ssignment access depending on new state. |
| Limits content Section assignment access d= epending on new Section. | |
| Limits content access depending on its Obj= ectStates. | |
| Limits content access depending on its own= er; access is only granted to the owner of the content. | |
| Limits content (create) access depending o= n parent location Content Type; access is only granted if the parent is of = this type of content. | |
| Limits content (create) access depending o= n parent location depth; access is only granted if the parent is at a given= depth of the tree structure. | |
| Limits content (create) access depending o= n parent location content owner; access is only granted if to = the owner of the Content item's parent. | |
| Limits content (create) access depending o= n parent location content owner's User group; access is only g= ranted to a User in the same User group as owner of the Content item'= s parent. | |
| Limits content access depending on its Section.<= /td> | |
| Limits access to an action depending on siteacce= ss, typically used for user/login. | |
| Limits content access depending on its sub= tree. | |
| UserGroupLimitation | Limits content access depending on its own= er's User group; access is only granted to a User in the same User group as= the owner. |