XF 1.1 Permissions Problem:

[CritiKiL]

Okay, I have assigned group permissions for members, and node permissions. I'm confused because I want certain areas to be private for 'clan members only', yet people who are not in that group are able to see those threads even though when I use the 'user test permissions' to follow what they should be able to see, it seems to work the way I want. When I use the test user permissions' and run it using one perticular person who is not in that group, it shows to be working.

But, I got an e-mail reply from a non-member of a 'watched thread' which is that same private (see subject title-only) thread! This means he must actually be able to see forum threads from which he is able to watch? He has NO user permissions at all, his group permissions says cannot have access and the node permission for that thread is set so that he can only SEE the subject title of those thread but NOT the contents, and the node permissions say that he can on

I'm wondering how many others are able to do this now so I'm puzzled. I have the nodes permission set so that non-clan members can only SEE the subject-name of the thread, but not the actual post (which is what I want) ~ And I verified all of this from 'user-test-view' for each person.

 

[Ingenious]

For private forums you should be utilising the option to make that forum private. Then, you normally create a new usergroup for people who can view that forum, and "allow" the viewing permissions for that usergroup only. To enable viewing of that forum for members, you just add them to that secondary usergroup group you created which has allowed viewing of that node.

Edit - sorry I note you did say you want thread titles to be visible. I'm not sure if what I wrote above allows for that too.

 

[CritiKiL]

So basically, 'dont allow anyone who is not in that usergroup to even SEE the node of the private forum?'

 

[Ingenious]

The easiest way to manage private forums is to make them completely invisible, by selecting the node option "Private node". Then, create a new usergroup leaving everything "not set", except for access to that node, where you "allow" the "view node" setting. So, adding that user to that secondary usergroup gives them full access to the node to see it and post etc. But no-one else, unless they are in that secondary group, will have access.

What I think you are asking is that everyone can see the threads titles however, but only certain usergroups can view the content. So I am not sure the above method can cater for that.

 

[CritiKiL]

Yes

What I think you are asking is that everyone can see the threads titles however, but only certain usergroups can view the content. So I am not sure the above method can cater for that.

Yes, THIS is what I was doing and what I 'thought' was working. Now I'm just confused and stubborn because I don't want the size of the forum to be minimized by having threads which cannot be seen. But if I have to do that then I'll have to make them private I guess...

 

[Ingenious]

I'm thinking if I was doing this, I would set "view thread content" to "revoke" for normal usergroups such as guests and registered (without access) and "allow" for the additional usergroup created for those who do have access. Really you want to avoid using "never" because that can never be overridden. So in this way, normal registered members have "revoked" (no) access set to view content but can see threads, then when you add them to the extra usergroup, they take in the "allow" option which takes priority. That's how I understand it.