1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Trying to understand permissions correctly...

Discussion in 'XenForo Questions and Support' started by discoian, Jul 4, 2011.

  1. discoian

    discoian Active Member

    Brain freeze!

    I have 4 user groups, guest, member, staff and admin. Each member (apart from staff and admin) will be a "guest" before they upgrade their account through the "account upgrades" link. At that point their secondary group is set to Member.

    The guest group has "view" and "view node" permissions set to "allow" everything else is set to "not set"

    In node permissions this is where I get confused. I set the permissions for each of the nodes, for the "guest" group most of them are set to "inherit" because how I understand it is that if their secondary group has "better" permissions than their primary group then they inherit the better permissions.

    Is this correct?

    Also, some of my nodes are inside categories, what sort of permissions do I apply to the categories? The same as the nodes inside it?
     
  2. James

    James Well-Known Member

    Your primary usergroup "Guest" will have to have all of the permissions set to either allow or deny. Setting them to inherit will effectively set them to no.

    Once you've set your guest permissions up, set only the Member permissions that differ from the guest permissions. Then when they upgrade their new usergroup's permissions will override the guest ones.

    As for your nodes, just set up any permissions for categories and they will automatically be inherited by the child nodes. If you don't need any specific permissions for categories, don't set any.
     
  3. discoian

    discoian Active Member

    Ok i've had another read of the manual.

    In group permissions for the Guest usergroup everything is pretty much set to "Not set" apart from the odd "Allow" here and there. From what I understand if the Member usergroup has more "allows" then the permissions of both the "guest" and "member" usergroups will be merged with the guest now taking on the better priviledges.

    Now with Node permissions it gets more complicated. I think i'm lost with the terminology...

    Never - understand this
    Allow - understand this

    Inherit - takes it's value from the parent - what does this mean exactly? Parent what? Parent node?

    Revoke - again what does this mean? If I have guest permissions set to revoke and member permissions set to allow, if that member's primary group is guest and their secondary group is member they get the allows?
     
  4. Brogan

    Brogan XenForo Moderator Staff Member

    Permissions are cumulative but the important point to note is:

    Permission value priority is set in this order: (highest priority first)
    1. Never – this will not grant the permission. This can never be overridden, so should be used sparingly.
    2. Allow – this will grant the permission.
    3. Not Set (No) – this will not grant the permission. This is the lowest priority value; any explicit allow will override this.
    This may help: http://xenforo.com/help/permissions/
    And this: http://xenforo.com/help/user-groups/

    Edit: Ninja'ed as I was posting.

    Revoke removes the permission which has been set to allow in the user group.
     
  5. discoian

    discoian Active Member

    Thanks for this, I understand the usergroup permissions now but the node permissions are baffling me. Node permissions are highest priority first but i'm confused by "revoke" and "inherit"

    Is it...

    If I do not want my guests to have access to a particular node I "revoke" access.
    If I do want a member to access a node I "allow" access.

    If a member's primary group is "guest" and their secondary group is "member" will they have access to that node or not?

    Is a "category" a parent node? What permissions do I apply to that? Same as those inside it and then just set all the nodes inside that category to "inherit" ???
     
  6. discoian

    discoian Active Member

    Sorry, i'm sure this is really simple...and so am I!
     
  7. James

    James Well-Known Member

    http://xenforo.com/community/threads/understanding-permissions.5830/
    See if this helps.

    The fundamentals should be that the guest usergroup has the base permissions for all of your users, then the secondary groups (member/staff) have the inherited permissions. Example:
    Guest may have:
    View Node - Allow
    Post Thread - Allow
    Reply to Thread - Deny

    Member may then have:
    View Node - not set
    Post Thread - not set
    Reply to Thread - allow

    Only the permissions that differ from your base usergroup (Guest in your case) should be changed.
     
  8. discoian

    discoian Active Member

    Ok yup, group permissions understood...node permissions still baffling...
     
  9. Brogan

    Brogan XenForo Moderator Staff Member

    The parent node is the node right at the top of the tree.
    The permissions applied to that node will apply to all child nodes, unless they have specific permissions applied to them.

    Primary and Secondary groups have no relevance when it comes to permissions.
    Permissions are cumulative across all groups a user is a member of.

    If one of the groups has Allow set then the overall permissions will be Allow.
     
  10. discoian

    discoian Active Member

    Ok so..

    If I do not want my guests to have access to a particular node I "revoke" access.
    If I do want a member to access a node I "allow" access.

    If a member's primary group is "guest" and their secondary group is "member" will they have access to that node or not?
     
  11. discoian

    discoian Active Member

    I guess what i'm asking is that if you have a Revoke and an Explicit Allow, the permission is "Allow"
     
  12. James

    James Well-Known Member


    Jake did the math ;)
     
  13. Brogan

    Brogan XenForo Moderator Staff Member

    Edit: See above.
     
  14. discoian

    discoian Active Member

    Yep, all done and sorted...brain unfrozen.

    Thanks chaps, really appreciate it.
     

Share This Page