XF 1.4 profile posts permissions question

[Mr Lucky]

If a user does not have permissions to post or view profile posts, it seems those users who do have permission to view and post can post on that users profile.

This makes no sense, is there a way to stop people posting on the profile of a user who cannot see or respond to those posts?

Maybe I'm missing something very obvious.

 

[Amaury]

That's as designed, I'd say.

Other than revoking the Post new profile posts permission, you could change that user's privacy settings.

 

[Mr Lucky]

That's as designed, I'd say.

Why would it be designed like that?

Other than revoking the Post new profile posts permission, you could change that user's privacy settings.

It's not a specific user, it's any usergroup that doens't have permission to view or write profile posts.

Nothing stops usergroups with those permissions from writing on those profiles, which seems wrong if the person cannot see or respond what is written there.

The person who writes something may not know the other person can't see or respond, and hence think them to be rude.

 

[Amaury]

Why would it be designed like that?

It makes perfect sense, if you think about it.

• User Group A: Cannot view or make profile posts
• User Group B: Can view or make profile posts

So it makes sense that members of user group B can make profile posts on the profiles of members who belong to user group A.

 

[Mr Lucky]

It makes perfect sense, if you think about it.

• User Group A: Cannot view or make profile posts
• User Group B: Can view or make profile posts

So it makes sense that members of user group B can make profile posts on the profiles of members who belong to user group A.

Why?

If I can't view posts on my profile, I wouldn't be happy that other people are making them there.

Maybe you aren't understanding what my point is.

Put it this way: would you like it if people are posting on your profile, asking you stuff or saying things about you, but you don't know about it?

 

[Paul B]

How is that different to members posting about other members in forums they don't have access to?

 

[Chris D]

Just to confirm, this is working as expected. Those users who can't view profile posts may wish to change their privacy settings to prevent users from posting on their profile - as an admin you can also set this on their behalf in the Admin CP.

Aside from these solutions, it is a valid suggestion so it may be worth posting it as one (if it doesn't exist already).

 

[Mr Lucky]

How is that different to members posting about other members in forums they don't have access to?

Because that is not on the person's profile.

 

[Mr Lucky]

Just to confirm, this is working as expected. Those users who can't view profile posts may wish to change their privacy settings to prevent users from posting on their profile - as an admin you can also set this on their behalf in the Admin CP.

Thanks Chris, this is what I'm looking for.

However, I just tried that, but people with permissions can still post on someone's profile who has not ticked the "post messages" box.




If I tick the box I cannot choose "nobody" as that option is not available. How should this work?

 

[Chris D]

Unticking the box is the same as Nobody.

 

[Mr Lucky]

Unticking the box is the same as Nobody.

That's what I thought, however it's still possible for those with permissions to post there.

 

[Chris D]

It's likely possible that members who have the bypass privacy permission can, but normal users shouldn't.

 

[Mr Lucky]

It's likely possible that members who have the bypass privacy permission can, but normal users shouldn't.

Aha, that would explain it, thanks for the helpful answers!

BTW, is there a way to batch set all users to have that box unticked?

 

[Chris D]

Unfortunately not (actually it could be done directly in the database if necessary).

It's possible to set it as the default for new registrations (Admin CP > Options > User Registration)

 

[Mr Lucky]

Unfortunately not (actually it could be done directly in the database if necessary).

Is that complicated?

 

[Chris D]

It depends.

If you want to set that for all users (this would effectively disable posting on profiles at all), then it's quite a simple query that sets the allow_post_profile column to "none" in the xf_user_privacy table.

If you want to set it conditionally based on user group membership or other things then the query becomes much more complicated.

 

[Mr Lucky]

If you want to set that for all users (this would effectively disable posting on profiles at all), then it's quite a simple query that sets the allow_post_profile column to "none" in the xf_user_privacy table.

No, that's all I need. Can you tell me what the query would be? Thanks

 

[Chris D]

UPDATE xf_user_privacy SET allow_post_profile = 'none'

Please take a back up first.

 

[Mr Lucky]

Many thanks Chris. This was extremely helpful.