Moderator Permissions

Brophy

Hello,

I wonder if you can help.

Our site is heavily community/gaming based. Our players who create in-game groups or gangs are given their own private forums to use and we also give them moderator permissions over those forums.

I just want them to be moderators for those forums only, I do not want them to able to see IP, Sessions or Emails used due to them being a 'moderator'.

Is there any way we can restrict this setting to perhaps global moderator/admins

Brophy

Apologies, but just bumping the question.

oplik0

I have the same problem...
For now I handled it by manually editing some NodeBB files:
in src/middleware/user.js in function middleware.checkAccountPermissions I changed line 135:

// For the account/info page only, allow plain moderators through
if (/user\/.+\/info$/.test(req.path)) {
	user.isModeratorOfAnyCategory(req.uid, next);
}

to :

// For the account/info page only, allow adminstrators and global moderators through
if (/user\/.+\/info$/.test(req.path)) {
	user.isAdminOrGlobalMod(req.uid, next);
}

That should limit user info page to only administrators and global moderators, but just to be sure I also (err... Actually, that's what I did first, only later noticing the possible change in middleware) modified src/controllers/accounts/info.js changing all isAdminOrGlobalModeratorOrModerator to isAdminOrGlobalModerator - that actually just makes the page not render for category moderators, causing 504 error after some time. The middleware change actually makes the website display a proper "access denied" page

As for seeing user IPs in posts, I had to modify src/socket.io/tools.js. More specifically, line 76:

if (!results.isAdmin && !results.isGlobalMod && !results.isModerator) {
	posts.ip = undefined;
}

had to be changed to:

if (!results.isAdmin && !results.isGlobalMod) {
	posts.ip = undefined;
}

And now only admins and global mods get to see the IP in post tools

Now, there is one more problem I didn't yet manage to find a solution to: if you are a moderator, you can see recent ips on users profiles in the source of the page. They are hidden with display: none, so you have to actually look at the source, but still - it would be better if this was visible only to administrators and global moderators :V I haven't found the code responsible for adding this invisible element, so I wasn't able to change it.

Oh, and obviously this probably isn't the best method of changing things, as you are modifying your local NodeBB installation and I have no idea what will happen with updates. But it works, and I don't see a better way of doing that right now.

Brophy

Thank you very much, I hope this gets added as functionality in the admin panel as I can imagine it can be tedious to keep adding it with every update.

oplik0

It is actually planned:
https://github.com/NodeBB/NodeBB/issues/5736
Two of the permissions that are supposed to be split are Global account info access and
Global user sessions access.
Unfortunately, there seems to be no ETA, and the issue is from 2017, so it might take some time before it's added... But there is hope