Restrict Access Plugin

[tmiranda]

If you are looking for a way to prevent what actions users can perform, look no further. This plugin allows you to password-restrict option changes, configuration changes, recording schedule modifications, file deletions and most Sage options and settings.

To install:

1. Install from the "UI Mod" section of the Plugin Manager.
2. A new item titled "Manage STV Permissions" will be added to the Setup -> Detailed Setup -> Server menu. Go there to configure the permissions.
3. You should put these lines in the file named RemoteClients.properties.defaults in your SageTV server install directory so any new extenders that are connected or placeshifter users that log in from different locations inherit the appropriate restrictions. Note that this file is overwritten each time you reinstall Sage so you will have to re-add these lines after each re-install or upgrade. (You WILL need to stop Sage before editing this file.) PASSWORDx should be the actual password you want to assign.

rra/enabled=true
rra/delete_enabled=true
rra/record_enabled=true
rra/config_enabled=true
rra/server_enabled=true
rra/delete_pwd=PASSWORD1
rra/record_pwd=PASSWORD2
rra/config_pwd=PASSWORD3
rra/server_pwd=PASSWORD4

Configuration:

1. From the configuration pop-up, click on the "Disabled" button to toggle between Enabling and Disabling.
2. When Enabled you will see three columns: Category, Status and Duration.
3. Click on the items under the Category column to change the password for each category (Server Configuration, Local Configuration, Record, Delete).
4. Once granted "Delete" privileges the user will be able to delete recordings and other media types.
5. Once granted "Record" privileges the user will be able to setup recordings, modify recording schedules, modify favorites and watch live TV. (Watching Live TV is considered to be creating a "recording.")
6. Once granted "Local Config" privileges the user will be able to change configuration items that only effect the current client/placeshifter/extender.
7. Once granted "Server Config" privileges the user will be able to change configuration items that effect ALL clients/placeshifters/extenders.
8. Passwords can be the same or different for each category. If they are the same the user will be granted access to functions in that category if ANY of the other categories with a matching password have access.
9. The Status column Enables or Disables password checking on a particular category.
10. The Duration column specifies how often passwords are checked. It can be set to "Always", "Once" or for a specified number of minutes after successfully entering the password. (Useful if you want to "unlock" a STV for a few minutes while you make changes then automatically "relock" it when complete.)
11. Assign Actions to Categories allows you to change which types of activities are associated with each category. So if you think watching live TV should require server level access, change the category of "Live TV" from "Record" to "Server Config". If you think watching live TV should not require a password at all change the category to "None".
12. Name Categories allows you to change the name of each category to anything meaningful to you.

Notes:

1. Passwords are not encrypted so browsing the filesystem will require the Server Config password to be entered.
2. Since passwords are not encrypted it will be pretty easy for a moderately knowledgeable person to get around the password protection, so use it at your own risk. The plugin is not meant to keep away serious hackers, it's meant to keep kids, babysitters, and in-laws from accidentally changings things that should not be changed.
3. There are no restrictions on setting and unsetting the "watched" status of recordings or videos.
4. There are no restrictions on playlist manipulations.
5. If you use other plugins the functions they provide will not be restricted.

If you intend to use this to restrict placeshifter users:

This is slightly more complicated because you must use a client (or the server UI) to create an STV that will become the default STV for a placeshifter user.

1. Install the plugin.
2. Launch Studio and select "File -> Save A Copy As..." Do NOT choose "Save As..."
3. Name the modified STV to something meaningful such as "STV For PlaceShifter Users.xml".
4. Don't forget to edit the RemoteClients.properties.defaults file as mentioned above!
5. Use the normal process to assign the newly created STV as the default STV for placeshifter users. (Setup->Detailed Setup->Server->Manage Placeshifter Users. Click on the user name and change the default STV to the one you just created and renamed.)

[bsung]

Great! Thanks. This was definitely a feature that I was hoping for. I also didn't know how to set up default properties for clients/placeshifters and it was very helpful to have the thorough explanation you included.

[tmiranda]

Thanks.

Keep an eye out for functions that I did not "trap". There are so many things that need checking it's inevitable that I missed some.

[bsung]

Is there any way to add lock out options to each of the main menu items (photos, videos, music and search) as well? Ideally, you'd be able to selectively lock out embarassing high school videos but if that's a lot more involved, just being able to shut out all the photos, videos, etc would be good enough.

[tmiranda]

That's not in there right now. I can look into it but no promises.

[PLUCKYHD]

Tom,

I am looking at breaking my user restrictions from SMM into their own api perhaps we could merge projects?

[tmiranda]

Originally Posted by PLUCKYHD

Tom,

I am looking at breaking my user restrictions from SMM into their own api perhaps we could merge projects?

Sure. PM me with the details of what you have in mind.

[salsbst]

tmiranda, this thing rocks. I just set up a guest room extender with this plugin and all seems good. Love it, so thanks a ton. It'll get a workout this weekend with siblings and their kids in town. I wish it could suppress watched/non-watched markers and "current point in recording" info, but I understand that that stuff may be too deep in the SageTV engine to control.

So anyway, awesome work. When the siblings leave town and I haven't lost any of my Bourdains and my recording schedule hasn't been f'ed with, I'll thank you again. And thanks to Lester for cluing me into it.

[Comitizer]

This plugin looks great!

Would it be possible for you to add an permission that would disable the ability to delete "Archive" recordings? I use BMT to import all of my saved recordings. I set the archive flag so they don't show up in my main lists. However, it's totally possible to delete those files. I'd prefer that people not be able to do so.

Thanks for the consideration.

[tmiranda]

Originally Posted by salsbst

So anyway, awesome work. When the siblings leave town and I haven't lost any of my Bourdains and my recording schedule hasn't been f'ed with, I'll thank you again. And thanks to Lester for cluing me into it.

[tmiranda]

Originally Posted by Comitizer

Would it be possible for you to add an permission that would disable the ability to delete "Archive" recordings? I use BMT to import all of my saved recordings. I set the archive flag so they don't show up in my main lists. However, it's totally possible to delete those files. I'd prefer that people not be able to do so.

You can disallow ALL deletion, but not allow/disallow based on being archived. Sorry, but I don't see that changing.

As a workaround you can probably set the physical files to be read-only so Sage can't delete them. (When you press delete they will disappear from the list, but once Sage figures out that the file is still there they will reappear.)

[Comitizer]

Originally Posted by tmiranda

You can disallow ALL deletion, but not allow/disallow based on being archived. Sorry, but I don't see that changing.

As a workaround you can probably set the physical files to be read-only so Sage can't delete them. (When you press delete they will disappear from the list, but once Sage figures out that the file is still there they will reappear.)

Ok, sounds good. Thanks.

[tmiranda]

Is anybody using this PlugIn? If not I will EOL it instead of migrating it from Google Code to GitHub.

[Rob23]

I apologize for bringing back this thread, but my Google skills are failing me. How does one get the functionality of this plugin (i.e. restrict users' actions) in the current environment (i.e. v9)? I see in detailed setup there is a "permissions" section that allows for the addition of user profiles, but I can't find any documentation on this. It looks like the user profiles are hardware dependent, and I am unclear as to whether different users on a single extender can be forced to login at startup. If anyone can point me to the relevant documentation I would appreciate it.

Kids are causing problems with missed favorites due to their creating way too many manual recordings. I want to restrict their ability to create recordings.

[tmiranda]

Originally Posted by Rob23

I apologize for bringing back this thread, but my Google skills are failing me. How does one get the functionality of this plugin (i.e. restrict users' actions) in the current environment (i.e. v9)? I see in detailed setup there is a "permissions" section that allows for the addition of user profiles, but I can't find any documentation on this. It looks like the user profiles are hardware dependent, and I am unclear as to whether different users on a single extender can be forced to login at startup. If anyone can point me to the relevant documentation I would appreciate it.

Kids are causing problems with missed favorites due to their creating way too many manual recordings. I want to restrict their ability to create recordings.

Wow, it's been so long since I've looked at this I honestly don't remember

If I recall, the user profiles are not hardware dependent. They are based on the server so any client will have the same permissions.