XF 1.4 Updating user Node Permissions

[RichardKYA]

Hello,

I'm not sure if this is right or not, but when I update a users node permissions, I also have to click the "Update" button below the "Private Node" checkbox before the new user node permissions take affect.

I have to click this one first which is at the bottom of the user node permissions.....



....and it saves the new changes fine, but they won't have any affect until I also click this one as well.....



Is this how it should be or is there something not right here?

I can duplicate this every time, on any node, with any user.

Any help would be appreciated

Thank you

 

[Zynektic]

If you set it as a private node, you then need to adjust the permissions for 'View Node' to allow for whatever usergroup you want to see it. That requires to edits so saving twice.

 

[Paul B]

The [Update] button on the node permissions screen only applies to the 'Private node' option.

When you edit a user's permissions and save, do they appear listed at the bottom under the 'Users' section?
If so, when you click on the name and check, are the custom permissions still set?

 

[RichardKYA]

The [Update] button on the node permissions screen only applies to the 'Private node' option.

When you edit a user's permissions and save, do they appear listed at the bottom under the 'Users' section?
If so, when you click on the name and check, are the custom permissions still set?

Yes and Yes. They appear in the list and the permissions are still set. It only happens with individual user permissions.

For example, on any node I can set the "Registered" User Group "View Node" permission to "Revoke" and it will work instantly without having to click the "Update" button below the "private node" checkbox. Then on the same node, I will set an individual user permission to "allow", I will click "Update permissions", they will appear in the list, the permission is still set to "Allow", but I am unable to view the node in that users account until I also click "Update" below "private node".

 

[RichardKYA]

If you set it as a private node, you then need to adjust the permissions for 'View Node' to allow for whatever usergroup you want to see it. That requires to edits so saving twice.

I'm not setting it as private.

 

[Paul B]

but I am unable to view the node in that users account until I also click "Update" below "private node".

Are you logging in via their account or using the test permissions function?

Be aware there are caveats with the latter so I suspect there isn't the problem you suspect there to be.

 

[RichardKYA]

I am logged via their account.

"02 - Basic" is the user group "Registered"

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.

Accept third party cookies

 

[Mike]

By "changing" the private node setting, you're likely triggering a much larger permission rebuild. It's certainly possible there is an add-on at play here. I would try disabling all add-ons (regardless of whether you think they're involved) and see if you can still reproduce it. To ensure that everything is in the correct state, after disabling the add-ons but doing the permission test, I would recommend rebuilding the user cache.

 

[RichardKYA]

Hi @Mike,

I disabled all add-ons, rebuilt the user cache and the permissions cache. I then done the same test a few times and it is still the same. Individual user permissions do not take affect until I click "Update" (below private node).

It also works the other way to, as in, if I set a users permissions and click both "update permissions" and "update", they will have access to the node, but if I then change their user permission back to "inherit" and click "Update Permissions", they are removed from the node user list, as expected, BUT if I DO NOT click "Update" below private node, they can still view the node.

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.

Accept third party cookies

 

[Paul B]

Aren't you using aMember?

Doesn't that fundamentally change how permissions and user groups work?

 

[RichardKYA]

Aren't you using aMember?

Yes, but you can see in the video all the add-ons are turned off, I also rebuilt the user and permissions caches.

I wonder if it's because I set the user group node permission to "revoke", that it is seen as a kind of a "private" setting and needs a larger permissions rebuild?

Could you copy the node permissions test that I do in the video and see if it happens on your installation please?

 

[RichardKYA]

Doesn't that fundamentally change how permissions and user groups work?

I think it will just change the users group that members are added to when their system adds the user to a group. For instance, if I add a user into a group inside XF, but not via aMember, when aMember updates this particular member's user groups, it won't add them to the group that they were added to inside XF. If that makes sense.

I can't say for certain, but I don't think it touches the permissions system, I think it's just adding to and removing from user groups and I believe it lets XF update the permissions combo. But don't quote me on that.

And due to our past conversations, I always think to contact aMember first if it's something like this, which I did on Thursday to see if their script does touch the permissions system, but I doubt I will hear anything from them until Monday because they don't usually respond over the weekend.

But like I say, at the moment, it's not enabled, that's why I am here asking the XF team if it is to be expected, just in case it is normal behaviour in XF

 

[Paul B]

I am unable to reproduce it and if it was a known problem, we would have heard about if before now.

It all works as designed for me, simply by saving the node permissions for the member.

 

[RichardKYA]

OK, cool. Thank you for trying it out.

I'll wait to hear what aMember has to say about it.

In the meantime, I'll try updating to 1.4.6 to see if that changes anything.

**Edit** Maybe I'll try 1.4.7 instead lol

 

[RichardKYA]

Not sure if this is correct behaviour either, but I've just noticed that changing the "Registered" View Node user group permission to revoke, also prevents me, Super Admin, from viewing the node as well. This isn't right either, is it? As Admin, I should be able to view all nodes regardless of a nodes user group permissions, right?

I am a member of both "Registered" and "Admin" user groups as well, using the XF combo way.

 

[Paul B]

This isn't right either, is it?

If you are a member of the Registered user group, that's correct.

Administrators are no different to other members as far as front end permissions are concerned.

 

[RichardKYA]

Administrators are no different to other members as far as front end permissions are concerned.

Is it the same for Super Moderators?

 

[Paul B]

Yes.

 

[RichardKYA]

OK, thank you

 

[RichardKYA]

Before I update to 1.4.7

Are the e-mail templates affected? I've removed most of the inline styling, will that be overwritten?