CMS – data model, permissions and limitations
Storage of the blog article and topic master data, comment handling and anti-spam, how permissions are checked and the known differences from other modules.
Overview
A copy of the web framework's built-in blog with the system's own tables. Permission comes from the framework's route-level modify right; the system's function permission applies only to the Add button (canAction(add)) and to menu visibility (canSee(list)).
Data model
Table names carry the installation's own prefix in the database.
| Table | Role |
|---|---|
article, article_description | article and per-language name, meta, author, text |
article_to_store, article_to_label, article_to_layout | store, label and layout links |
article_rating, article_comment | ratings and comments |
topic, topic_description, topic_to_store | blog topics |
framework seo_url, antispam | web addresses and blocked keywords |
Process
- Saving an article: name, meta title and author required per language; the SEO keyword must be unique and valid;
addArticleoreditArticle(description, store, label, layout,seo_url). Delete:deleteArticle. article.rating: recalculates the article rating from like and dislike votes.- Comments: approval (marks the commenter as trusted in the framework's customer model and approves their pending comments), spam marking, deletion, rating — on the framework's
cms/articlemodel. - Anti-spam: blocked keywords on the framework's
cms/antispammodel.
Permissions
- Article save, delete, rating:
hasPermission('modify', 'cms/article'); topic:cms/topic. - Comments and anti-spam: the
modifyright refers to the framework's own route (cms/comment,cms/antispam), not the system's route. - The controller does not check the
listpermission of the lists.
Known limitations
- The language keys of the menu and submenu are missing from the English language file.
cms/article.seedDemoArticles: a public method that inserts demo articles with fixed label IDs, without a permission check.cms/article.tagselect: returns random demo labels and writes no data.