Permissions Confusion (Image Attached)


Active member
I've attached what I am looking , and maybe you will see right away why I am confused. I am trying to wrap my head around these permissions and have had some troubles with members lately not being able to reply to threads because of permissions.

Background: My forum is an import from VB. My user group "Registered and Not Paid" is obviously those from the old forum who had registered and not paid for a user upgrade. The Paid membership is set to be activated so when the user upgrades, they are put into that second category.

I do have a few members set to Paid Membership only, and they can access everything, since they are allowed that. However, in the Registered/Not Paid group, there are permissions set to "no" so they can't see or access anything. If the allow overrides them in the second "Paid" group when the upgrade, why is it that they still cannot reply. I am guessing it has to do with the Node Permissions but I can't figure out why certain things are the way they are.

For example: You can see in my Node Tree, some Permissions are blue and some aren't marked that way. So I took some screen shots to show the difference here. Under hardware, those usergroups are marked (or active, not really sure what the blue means). But under the node tree>Computer Help, it's not blue and there are not user groups in blue.

When I go one step further and open up the "Registered/Not Paid" group in both Categories, one has the yellow Revoke, and the other doesnt. Is there a setting here that looks off or that I am missing?

Did my questions make sense?XenForo permissions help.jpg

Jake Bunce

XenForo moderator
Staff member
Revoke can only be overridden by an explicit Allow, not an inherited allow:

Only an explicit Allow (as opposed to an inherited Allow) can override a Revoke. A Revoke is designed to trump inherited access and reduce a user's permissions unless you explicitly Allow (no inheritance) that permission elsewhere in the Node Permissions (e.g. for one of the user's other groups).
The importer translates vB's "No" permissions into "Revoke", but the two are not functionally equivalent. In vB the No permission is additive, but in XF the Revoke permission is subtractive. That's why it doesn't function the same in XF even though the permissions were imported.


Active member
Aha! There it is :) The VB import & Revoke were throwing me off. Thank you for clarifying and hopefully this thread helps someone else in the future! Have a great Thanksgiving! :D