Document Library Pro lets you restrict access to parts or all of your document library - either globally, by category or individual document; and by password, user or role. This article explains the logic which is used when you combine multiple types of protection. By understanding these rules, you can protect your categories in the correct way.

Combining multiple levels of protection

Principle 1: Protection is always inherited from above.

By default, when you protect your document library at any level, then everything that falls underneath it automatically inherits the same protection.

This means that:

• The global visibility settings for your overall document library will be used for all documents and categories.
• If you set category-level protections then these will be used for all the categories' sub-categories and the documents within.
• If you change the visibility for a sub-category then this will be used for all sub-categories below it and the documents within.

You can override each of these inherited protections by changing the visibility settings of categories, sub-categories and individual documents. When you do this, Principle 2 takes effect:

Principle 2: The most fine-grained level of control will always take precedence.

For maximum security and to avoid any mistakes, Document Library Pro will always apply the protection for the lowest possible level that it has been set. This means that:

• Category-level protections override the global visibility settings for your entire document library.
• Sub-category-level protections override the visibility settings for their parent category.
• Individual document-level restrictions override the global or category-level protections.

Using multiple types of protection (e.g. password and user protected)

Principle 3: If a library or document has multiple types of protection, it can be unlocked by any of these methods. 

You can apply multiple different types of protection at once:

• Password protection
• User protection (restricted to specific users)
• Role protection (restricted to specific user roles)
• The user who created the document

If a library or document has multiple types of protection, it - and any of the documents it contains - will be protected. However it can be 'unlocked' by any of the required means. For example, if it is password and user protected, it can be unlocked either by entering the correct password, or by logging in with the required user account(s).

Example 1

A document category has password protection and user role protection:

In this example, when you visit the document category page (or one of its documents) the plugin will perform the following checks:

Is the user logged in?

1. Yes, the user is logged in. Do they have the administrator role?
   1. Yes, the category is unlocked.
   2. No, the user has a different role. Has the correct password been entered?
      1. Yes, the category is unlocked.
      2. No, the password form is displayed.
2. No, the user is not logged in. Has the correct password been entered?
   1. Yes, the category is unlocked.
   2. No, the password form is displayed.

Example 2

Your document category has user protection and role protection:

In this example, the plugin will perform the following checks:

Is the user logged in?

1. Yes, the user is logged in. Are they one of the users allowed to access this category?
   1. Yes, the category is unlocked.
   2. No, the user account is not permitted. Do they have the editor role?
      1. Yes, the category is unlocked.
      2. No, the login page is displayed.
2. No, the user is not logged in. The login page is displayed.

The important point to note is that when a category has multiple types of protection, it can be unlocked by any of the required methods. If it is unlocked in any way, then it's considered 'unlocked' and can be viewed by that user.

Documents in multiple categories

Documents can be placed in more than one category. If you place a document in more than one category, what is displayed to the user will vary depending on the type of protection for the individual categories (see above).

Document is in a Public and a Protected category

For security reasons, Document Library Pro will restrict access to documents that are in both a public and protected category. In this case, the document will be protected, and unauthorized users will see the login page. The document can be unlocked by any of the required means of protection. So if the protected category is password protected, it can only be unlocked by entering the correct password.

Principle 4: If a document is in two or more protected categories, it can be unlocked by any of the required methods for any category it is part of. 

Document in multiple password protected categories

Principle 5: A document can only be in more than one password protected category if they share the same password. 

If you put a document in multiple password protected categories, each with different passwords, then no one will be able to access it - regardless of which password they enter. This is because the password protection option works in the same way as the password protection for pages and posts that is built into WordPress itself, which only supports one password at a time.

These are our suggested workarounds:

• Set the same password for each category.
• Instead of password protecting both categories, you can create a parent and child category structure where only the parent category is password protected.
• Protect one or both categories with user or role protection, instead of password protection. That way, Principle 6 applies.
• If you really need your documents to be in two password protected categories, each with different passwords, then you should use the free Duplicate Post plugin to clone your documents and put one in each password protected category. That way, you're not putting the same document in multiple password protected categories.

Document in multiple user or role protected categories

Principle 6: A document can only be in more than one role protected category if they are available to the same roles.

Similarly, if you put a document in multiple role protected categories, each with different roles selected, then no one will be able to access it - regardless of which role they are logged in as.

For example, if a document is in Category A and Category B, each of which are restricted to different roles, then this will cause a conflict.

Instead we recommend restructuring your categories to avoid this situation.

Related Articles

• How to translate any Barn2 plugin with WPML
• Is Document Library Pro accessible?
• How to set documents to expire and remove them from the library
• Can I add a full-width description under the document name and other data?
• Where can I store the documents?
• How to add social sharing to documents