• Documentation >
• Guide >
• Permissions >
• Limitations

Limitations

Limitations are part of the permissions system. They limit the access granted to users by Policies. While a Policy grants the user access to a function, Limitations narrow it down by different criteria.

Limitations consist of two parts:

• Limitation (Value)
• LimitationType

Certain Limitations also serve as Role Limitations, which means they can be used to limit the rights of a Role assignment. Currently this covers Subtree of Location and Section Limitations.

Limitation represents the value, while LimitationType deals with the business logic surrounding how it actually works and is enforced. LimitationTypes have two modes of operation in regards to permission logic (see eZ\Publish\SPI\Limitation\Type interface for more info):

Method	Use
evaluate	Evaluates if the User has access to a given object in a certain context (for instance the context can be Locations when the object is Content), under the condition of the Limitation value(s).
getCriterion	Generates a Criterion using Limitation value and current User which SearchService by default applies to search criteria for filtering search based on permissions.

Available Limitations

Tip

Core Policies with Limitations are defined in EzPublishCoreBundle/settings/policies.yaml.

Each function in one of the five modules (content, section, state, user, workflow) can be assigned different Limitations.

Functions without Limitations

If a function is not mentioned below, it can have no Limitations.

Content

All Content Policies can be assigned the Content Type and Section Limitation. Beyond that the following Limitations are available:

content/read:

• Owner
• Content Type Group
• Location
• Subtree of Location
• State

content/diff:

• Owner
• Location
• Subtree of Location

content/view_embed:

• Owner
• Location
• Subtree of Location

content/create:

• Location
• Subtree of Location
• Language
• Owner of Parent
• Content Type Group of Parent
• Content Type of Parent
• Parent Depth
• Field Group

content/edit:

• Owner
• Content Type Group
• Location
• Subtree of Location
• Language
• State
• Workflow Stage
• Field Group
• Version Lock

content/publish:

• Owner
• Content Type Group
• Location
• Subtree of Location
• Language
• State
• Workflow Stage

content/manage_locations:

• Owner
• Subtree of Location
• State

content/hide:

• Owner
• Content Type Group
• Location
• Subtree of Location
• Language

content/translate:

• Owner
• Location
• Subtree of Location
• Language

content/remove:

• Owner
• Location
• Subtree of Location
• State
• Language

content/versionread:

• Owner
• Status
• Location
• Subtree of Location
• State

content/versionremove:

• Owner
• Status
• Location
• Subtree of Location
• State

content/unlock:

• Owner
• Content Type Group
• Subtree of Location
• Language
• Version Lock

Section

section/assign:

• Content Type
• Section
• Owner
• New Section

State

state/assign:

• Content Type
• Section
• Owner
• Content Type Group
• Location
• Subtree of Location
• State
• New State

User

user/assign:

• SiteAccess

Workflow

workflow/change_stage:

• Workflow Transition

Segment

• Segment Group

Limitation reference

See Limitation reference for detailed information about individual Limitations.