We are using the IsolatedSites module in Omeka S to restrict certain users to a single site. These users have the role “Site Editor” and the option “Limit to granted sites” is enabled (which is enforced by the role).
The issue:
When these users view a resource (e.g., a Person item) that is linked to other resources via metadata fields (e.g., “has material”, “is related to”, etc.), the “Linked Resources” tab on the resource’s detail page appears empty . However, as a Super Admin, I can see all linked resources without any problems.
What we have already checked and confirmed:
- Site settings: The option “Exclude resources not in site” in the site settings (under “Show”) is disabled (no checkmark).
- Resource assignment: All resources (both the parent item and the linked resources) have been officially assigned to the site via the “Sites” tab on each resource.
- IsolatedSites module settings: The option “Exclude linked resources not in site” (or similarly named) within the IsolatedSites module configuration is disabled .
- User role: Changing the user role from “Site Editor” to other roles (e.g., “Editor” or “Researcher”) does not solve the problem.
Despite all these settings being correct, the “Linked Resources” tab remains empty for these restricted users. They can see the resources themselves (e.g., in browse lists), but the tab showing the relationships between resources is not populated.
The role “Site Editor” enforces the “Limit to granted sites” option. We cannot disable this for these users because Omeka S throws a configuration warning:
“Site Editor’ requires ‘limit_to_granted_sites’ enabled and at least one default site for items.”
Is there any additional hidden setting or known bug that prevents the “Linked Resources” tab from displaying for users with “Limit to granted sites” enabled? Is there a workaround or a code modification that could fix this?
Thank you for your help!
Emma
1 Like
Hi Emma,
I’m the maintainer of the IsolatedSites module. Thanks for the detailed report.
After checking this further, it looks like the issue is probably not caused by IsolatedSites.
The important test is that the same problem appears with IsolatedSites disabled and a regular Omeka S Editor account: the “Linked Resources” tab is still empty. That means the site-assignment settings and the “Exclude linked resources not in site” option are likely not involved here.
The issue seems to come from Omeka S core permissions. The “Linked Resources” tab loads its contents through the linked-resources action on the admin Index controller. In core, non-admin roles are allowed to access actions such as index, browse, show, and show-details, but linked-resources does not seem to be granted to roles below admin. As a result, the request is denied and the tab appears empty. Super Admins are not affected because they have broader admin access.
You can confirm this in the browser’s Network tab: the request to the linked-resources endpoint should return a permission-denied response for non-admin users.
This also explains why switching between Editor and Researcher does not solve it. Researcher is also not a very useful test case here, because it does not have the “view all” privilege and would only be able to see public linked resources anyway.
If this diagnosis is correct, the fix should be made in Omeka S core: linked-resources is a read-only view and should probably be allowed for the same roles that can already access show and show-details.
I’d prefer not to work around this in IsolatedSites, because that would make the module silently change core permission behaviour.
Thank you for your detailed diagnosis – that is very helpful!
I have now also tested this with a user who has the role “Supervisor” and is not restricted to a site via IsolatedSites. This user can see all linked resources in the “Linked Resources” tab without any issues.
This confirms your diagnosis: the problem is not caused by IsolatedSites or by any of our site settings. It is clearly a core permission issue in Omeka S.
Here is the full error message I receive for restricted users (Site Editor) when trying to load the tab:
Omeka\Mvc\Exception\PermissionDeniedException: Der Zugriff auf die Aktion “linked-resources” des Omeka\Controller\Admin\Index Controller wurde für den aktuellen Nutzer verweigert. in /nfs/projekt/bestand-tws/http/docs/application/src/Mvc/MvcListeners.php:502
Stack trace:
#0 /nfs/projekt/bestand-tws/http/docs/vendor/laminas/laminas-eventmanager/src/EventManager.php(318): Omeka\Mvc\MvcListeners->authorizeUserAgainstController()
#1 /nfs/projekt/bestand-tws/http/docs/vendor/laminas/laminas-eventmanager/src/EventManager.php(176): Laminas\EventManager\EventManager->triggerListeners()
#2 /nfs/projekt/bestand-tws/http/docs/vendor/laminas/laminas-mvc/src/Application.php(319): Laminas\EventManager\EventManager->triggerEventUntil()
#3 /nfs/projekt/bestand-tws/http/docs/index.php(26): Laminas\Mvc\Application->run()
#4 {main}
The browser’s Network tab shows that the request to linked-resources returns with a 500 status code for Site Editors, while it works fine for Supervisors.
Do you know if there is already an open issue for this in the Omeka S GitHub repository? If not, would it be helpful if I create one?
Thank you again for your support!