2007-01-25, 02:50 PM
I created a forum for which non-registered/non-logged in users have no permissions. I log out. I can still view it and it's contents. I also log out as admin. I can still view it.
Is this a bug? What does the lack of "view" permission prevent?
More info: "Hide Private Forums" is set to yes in "Forum Home Options". Version is 1.2.2
I can't believe no one has encountered this problem before. Doesn't anybody use the view permission (turn it off) to prevent viewing of a forum by unregistered people? How could something this big be wrong in the current release? I hope I am just doing something wrong but the more I look into it the more it is looking like a bug and a major one at that.
OK, Went to "Usergroup Management/Edit Usergroup: Unregistered / Not Logged In" and changed the viewing permissions: Can View Threads, Can Search Forums, Can View Profiles to "no". Now the private forum is not visible when I'm not logged in. So it does what I want now and I can live with that.
But it doesn't make sense to me or do what I would expect it to do from the option names and the documentation. I would expect that turning viewing off for the forum would be enough. I would expect that turning viewing off for the group would turn off viewing of all forums, not just this one. I still call it a bug, at least a documentation bug. Have these permission interactions been thought through carefully? Documented?
OK I found some documentation that seems to imply that this behavior is correct. At least it is what MyBB does -- what it should do is another matter:
Usergroups and Permissions
Currently in MyBB, the "yes" permission overrides any "no" permission. This poses a problem if you explicitly want to disable a certain permission for a usergroup if users in that usergroup are in another usergroup with "yes" permissions for the same permission.
Privacy is important so the tools for protecting privacy should be simple and clear. When settings conflict I think the decision should be toward more privacy not less as is the case here.
Is this a bug? What does the lack of "view" permission prevent?
More info: "Hide Private Forums" is set to yes in "Forum Home Options". Version is 1.2.2
I can't believe no one has encountered this problem before. Doesn't anybody use the view permission (turn it off) to prevent viewing of a forum by unregistered people? How could something this big be wrong in the current release? I hope I am just doing something wrong but the more I look into it the more it is looking like a bug and a major one at that.
thy Wrote:I created a forum for which non-registered/non-logged in users have no permissions. I log out. I can still view it and it's contents. I also log out as admin. I can still view it.
Is this a bug? What does the lack of "view" permission prevent?
More info: "Hide Private Forums" is set to yes in "Forum Home Options". Version is 1.2.2
OK, Went to "Usergroup Management/Edit Usergroup: Unregistered / Not Logged In" and changed the viewing permissions: Can View Threads, Can Search Forums, Can View Profiles to "no". Now the private forum is not visible when I'm not logged in. So it does what I want now and I can live with that.
But it doesn't make sense to me or do what I would expect it to do from the option names and the documentation. I would expect that turning viewing off for the forum would be enough. I would expect that turning viewing off for the group would turn off viewing of all forums, not just this one. I still call it a bug, at least a documentation bug. Have these permission interactions been thought through carefully? Documented?
thy Wrote:I can't believe no one has encountered this problem before. Doesn't anybody use the view permission (turn it off) to prevent viewing of a forum by unregistered people? How could something this big be wrong in the current release? I hope I am just doing something wrong but the more I look into it the more it is looking like a bug and a major one at that.
thy Wrote:I created a forum for which non-registered/non-logged in users have no permissions. I log out. I can still view it and it's contents. I also log out as admin. I can still view it.
Is this a bug? What does the lack of "view" permission prevent?
More info: "Hide Private Forums" is set to yes in "Forum Home Options". Version is 1.2.2
OK I found some documentation that seems to imply that this behavior is correct. At least it is what MyBB does -- what it should do is another matter:
Usergroups and Permissions
Currently in MyBB, the "yes" permission overrides any "no" permission. This poses a problem if you explicitly want to disable a certain permission for a usergroup if users in that usergroup are in another usergroup with "yes" permissions for the same permission.
Privacy is important so the tools for protecting privacy should be simple and clear. When settings conflict I think the decision should be toward more privacy not less as is the case here.
thy Wrote:OK, Went to "Usergroup Management/Edit Usergroup: Unregistered / Not Logged In" and changed the viewing permissions: Can View Threads, Can Search Forums, Can View Profiles to "no". Now the private forum is not visible when I'm not logged in. So it does what I want now and I can live with that.
But it doesn't make sense to me or do what I would expect it to do from the option names and the documentation. I would expect that turning viewing off for the forum would be enough. I would expect that turning viewing off for the group would turn off viewing of all forums, not just this one. I still call it a bug, at least a documentation bug. Have these permission interactions been thought through carefully? Documented?
thy Wrote:I can't believe no one has encountered this problem before. Doesn't anybody use the view permission (turn it off) to prevent viewing of a forum by unregistered people? How could something this big be wrong in the current release? I hope I am just doing something wrong but the more I look into it the more it is looking like a bug and a major one at that.
thy Wrote:I created a forum for which non-registered/non-logged in users have no permissions. I log out. I can still view it and it's contents. I also log out as admin. I can still view it.
Is this a bug? What does the lack of "view" permission prevent?
More info: "Hide Private Forums" is set to yes in "Forum Home Options". Version is 1.2.2