$page->move() in panel.page.create and permissions

Kirby 2 Questions 🤔
1

Hi community
Upon creation of a new page, I want to set it’s UID in panel.page.create hook. Furthermore, I want to prohibit further changes to the URL by the user.

To achieve the second requirement, I set url: false in the corresponding blueprint.

But doing so leads to PermissionsException when using $page->move() in my hook.

Does anyone have an idea for solving this?
Thanks a lot!

2

You can set up permissions for certain user roles. That way you can prevent users from changing the URL but should be able to still do that via the hook.

https://getkirby.com/docs/panel/permissions

If you have multiple user roles, you would have to set up a file for each affected user role.

3

Thanks, so the approach to go would be “permission states” to distinguish “ui” and “action”?

4

Yes, that should work.

5

The states approach seems to be the right path to go. This works as expected in a role’s permission array:

'panel.page.url'    => function(){
  if(($this->state() == 'ui') && ($this->target()->page()->intendedTemplate() == 'MY_TEMPLATE')) {
    return false;
  } else {
    return true;
  }
}

But I’d like to set this permission globally: It has to apply to each and every role/user (Admins included).

Some background info: My plugin fetches data from an external data source by implementing a panel.page.create hook. After that, the page’s UID has to be set accordingly to received data.

So therefore the need to globally prohibit moving pages but to allow it in panel.page.create…

6

Hm, I don’t quite understand the workflow:

  1. user creates a new page in the panel
  2. the panel.page.create hook chirps in and moves the page somewhere (depending on. what and why doesn’t this page get the right UID right from the beginning) and fetches data from some remote source
  3. After that, the UID is never ever changed again.

The only ways to set permissions is in blueprints and in user roles.

I think you can circumvent this problem by using a method that is not controlled by permissions, i.e. instead of using $page->move(), use some basic PHP and toolkit methods to rename the page.