XF 2.1 Private nodes

[Dubbed Navigator]

Hello

Question regarding private nodes.

The tick box for this gives the impression that for a user to have access, they would need explicitly granting permission.

So for my staff areas, I have granted administrative and moderating full rights.

No other user group touched.

Analysing the permissions, the registered usergroup shows they cannot view the node / category, but the rest are a yes as they are set to inherit?
To me this means if they were handed a link, they could see a thread?

I have set registered and unregistered to no just in case, but if someone could clarify that would be awesome.

 

[Martok]

If a node is marked as private, only the user groups you have set "View node" to Yes in that node would be able to see it. Inherit won't allow them to see the node.

You can always check for specific users if they can see a node if you use Analyze permissions in the ACP.

 

[Silent Kitty]

XF permission hierarchy goes Never -> Yes -> No -> Inherit

Setting a Node to private changes its default View permission from Inherit (which means Yes if you haven't touched anything else) to Never.

When a user accesses a Node they are effectively joining a "User Group" for that Node for the duration of the time they are interacting with the node.

For a user group to view a Private Node, the View Node permission for that User Group in that Node must be set to Yes.

When you leave a Node untouched, everything is inherited from the parent node and this continues all the way up the chain until you reach the forum wide settings. User Groups are effectively forum wide permission sets (the default) and Nodes change that default.

So no, even a direct link will not allow individuals from unapproved groups to see the contents of a private thread.

I would also recommend making a test account with normal user permissions and simply logging in with that to check your permission settings. Make sure that it can access what you want and can't access what you don't want.

 

[Martok]

Setting a Node to private changes its default View permission from Inherit (which means Yes if you haven't touched anything else) to Never.

When a user accesses a Node they are effectively joining a "User Group" for that Node for the duration of the time they are interacting with the node.

That explanation isn't accurate, there's no "joining of user groups" nor is the View permission set to Never. Never can never be overridden, even with an explicit Yes (which is what is added in the node for user groups that you want to see the private node).

It's more like the View permission is defaulted to No for all user groups in private nodes and a user group will only be able to see the private node if the node view permission for that user group is explicitly set to Yes.

There's more explanation on permissions in the resource below. Note that it was written for XF1 but it still applies to XF2. Note that Revoke and Not Set (No) are both now No and Allow is now Yes.

Unmaintained - Understanding Permissions

Types of Permissions Not Set (No) Not explicitly set. Effectively a No if there is no Allow in other applicable permission sets. In the Node Permissions this is Inherit which means that permission is inherited from the higher level User Group...

xenforo.com