Permission system change

<baris>

tldr

Permission system changed. After upgrading to 0.6.0 check your group permissions to make sure they are correct.

Long version

This is not really a breaking change so I am just posting here.

Related GH issues https://github.com/NodeBB/NodeBB/issues/2130 and https://github.com/NodeBB/NodeBB/issues/2382.

Previously if no options were ticked in the manage>categories permission dropdown it meant registered users can find, read, post topics and replies while guests could only find, read but can't create topics or reply. This was confusing as all the checkboxes were unticked. Also as soon as you ticked the permission for one group the other groups lost that permission.

From now on what you see in the permission drop down is what you get. If all checkboxes are unticked no group has permissions, if only one of them is ticked only that group has permissions and so on. Administrators are an exception so even if you remove their tick in the dropdown they can still access and post, so I'm not sure why we have admins in that dropdown

On a new install NodeBB will give all permissions to administrators and registered-users groups. When you create a new group from the ACP that group will not have any permissions so it is up to the forum admin to assign proper permissions.

The upgrade script will go through all categories and groups and assign permissions if there are no permissions set. This is to mimic the previous behaviour. So after upgrading to 0.6.0 you should go through your categories and make sure correct permissions are set for guests and possibly double check other groups.

Related commit https://github.com/NodeBB/NodeBB/commit/604dac88e3095b1ea130fe79fab97616d056206d

? Offline

Excellent. This makes much more sense

julian

Thanks for doing this @baris -- hopefully we won't get complaints that it is confusing anymore

As for why administrators is there, they only apply if you want to give admins read/write rights to a category that nobody else has, like a secret forum for admins only :shipit:

<baris>

Well I think those settings don't have any effect because of the other admin checks we have in here :

NodeBB/src/privileges/categories.js at master · NodeBB/NodeBB

Node.js based forum software built for the modern web - NodeBB/src/privileges/categories.js at master · NodeBB/NodeBB

GitHub (github.com)

If the user is an admin or mod for that category then the group permissions don't matter for them.