• Registered: 2004-01-17
  • Posts: 8

Topic: User groups?

hi,

I use phpBB actually and one nice feature is the possibility to create user groups, making permissions managment much easier.

Would it be possible to add possibility to create groups so that you can allow permissions for private forums to whole groups of users? A password is nice in a perfect world, but if you have someone who has access and you want to remove his right to access private forum, you can't do it with a password, unless you change it... removing the user from a usergroup is much simpler way to prevent him coming back in the private forum.

  • From: Gothenburg, Sweden
  • Registered: 2002-07-03
  • Posts: 946

Re: User groups?

You can use the Extended Forum Access Mod... though, it's not built on groups, so it's not that easy.

I've made some coding for a group-solution, though it's not done yet (and it hasn't gone through sufficient testing yet either. Dont know if I'll ever release it...)

3 Reply by Louis (edited by CSpotkill 2004-02-03 05:49)

  • Louis
  • Senior Member
  • Offline
  • From: Toronto, Canada
  • Registered: 2003-12-24
  • Posts: 197

Re: User groups?

I've also wanted to "group" my users, for both easier permissions configuration and for User list presentation ... I'd lean towards this being a good feature for 1.2, with Moderate Topic ? Make 1.2 the easy-to-admin release ;)

  • From: 127.0.0.1
  • Registered: 2001-11-02
  • Posts: 9,167

Re: User groups?

Yes, I would also like to have a good user group implementation. However, it's quite a large change and not something you whip up in an afternoon. Every single permission check in the code will have to be rewritten.

"Programming is like sex: one mistake and you have to support it for the rest of your life."

Rickard's Website

  • From: Gothenburg, Sweden
  • Registered: 2002-07-03
  • Posts: 946

Re: User groups?

Maybe I should release it then... though, it might work a bit different of what people wants. You set a forum to "Admins / Moderators only", and then lets speciall groups access the forum. This also means that every user that is a moderator in a forum can see the group-forums...

6 Reply by Louis (edited by Louis 2004-02-03 20:06)

  • Louis
  • Senior Member
  • Offline
  • From: Toronto, Canada
  • Registered: 2003-12-24
  • Posts: 197

Re: User groups?

What I was thinking of was something similar to Windows ACLs, where each forum would have an Access Control List (ACL), similar to the following screenshot. Imagine WINDOWS is a forum on the website and the permissions, like Read & Execute and List Folder Contents are more like Post Reply, Post New Topic ...

http://www.microsoft.com/mspress/images/it_FA_120601b.gif

So you create Access Control Entries and they are added to the Access Control List for the forum. This way it will completely eliminate much of the Permissions page as it stands now and if implemented well, we could even extend the ACLs with our own mod-permission ACEs. You could go even further and give every thread a seperate ACL, allowing for fine control of topics so administrators could create read-only stickies, for example.

I find the Windows ACL concept easier to understand than the current "Admin/Moderators only" check box ... it would give a central area to adjust security options, as right now we've permissions scattered through Profiles, Admin: Forums and Admin: Permissions. Plus, if you wanted a few specific people to not to have the ability to delete/modify posts, while allowing them to read a forum for moderators only, how would you do that with the current implementation? (Note: I haven't tried the mod ... but it sounds like ACLs would give more granular control and security is something we shouldn't brush off in these times.)

Perhaps we could leave this until "2.0" when we go through the code and rewrite it for CSS ;)

7 Reply by Louis (edited by Louis 2004-02-03 21:37)

  • Louis
  • Senior Member
  • Offline
  • From: Toronto, Canada
  • Registered: 2003-12-24
  • Posts: 197

Re: User groups?

(Chacmool`11th) http://www.etek.chalmers.se/~e0mool/pun … Access.png <-- ACL-style?
(Chacmool`11th) http://www.etek.chalmers.se/~e0mool/pun … Groups.png
(Chacmool`11th) http://www.etek.chalmers.se/~e0mool/pun … /Users.png
(Louis-CSpotkill) Access.png: hmm sort of ...
(Louis-CSpotkill) But I was thinking of making it *look* like in my screenshot too. Like having a list-control to select the user/group and the ability to add users/groups to the list-control, then by clicking a user/group it changes the bottom class to reflect the group's permissions.
(Louis-CSpotkill) ... and of having more granular control of the actions users and groups can perform inside that forum/thread ... as opposed to just who can access what forum
(Louis-CSpotkill) As for the Groups.png / Users.png, it's too cluttered and hard to understand ...
(Chacmool`11th) It's not that easy to have it all on one page as in windows (without using java).
(Louis-CSpotkill) Actually, it would be. You just display it all on one page, then use CSS to show-hide the permissions. The Add/Remove groups button would show a popup then reload the page, adding or removing the permissions for whichever user was added/removed.
(Louis-CSpotkill) You *might* need some JavaScript/ECMAScript for the select-name/change-CSS ...
(Chacmool`11th) Don't like popups =)
(Louis-CSpotkill) Not a true popup
(Louis-CSpotkill) a Cancel/OK window of some kind
(Chacmool`11th) Ahh, okay =)
(Louis-CSpotkill) we could even use CSS for it, yet again ;)
(Louis-CSpotkill) CSS is wonderful =D
(Chacmool`11th) True =)
(Chacmool`11th) ...still much to learn though =)

  • From: 127.0.0.1
  • Registered: 2001-11-02
  • Posts: 9,167

Re: User groups?

I like the idea of designing the user group/permission page after the Windows form above. We just have to be really careful that we don't start thinking up a hugely advanced permissions system that doesn't at all fit in with the "philosophy of PunBB". PunBB will have users groups and more fine-grained access control that it has now, but a feature such as topic level access control is out of the question.

"Programming is like sex: one mistake and you have to support it for the rest of your life."

Rickard's Website

9 Reply by Louis (edited by Louis 2004-02-03 21:58)

  • Louis
  • Senior Member
  • Offline
  • From: Toronto, Canada
  • Registered: 2003-12-24
  • Posts: 197

Re: User groups?

Rickard wrote:

... a feature such as topic level access control is out of the question.

Not even as an extension that you can enable inside the Control Panel if you want it? ;)

  • From: Gothenburg, Sweden
  • Registered: 2002-07-03
  • Posts: 946

Re: User groups?

Agree! It should be quite simple. I don't like the ultra-advanced feautures in the other forums. There's no need to set that amount of access-properties to a forum...

11 Reply by Louis (edited by Louis 2004-02-03 22:07)

  • Louis
  • Senior Member
  • Offline
  • From: Toronto, Canada
  • Registered: 2003-12-24
  • Posts: 197

Re: User groups?

I think using an ACL-style of permissions management makes sense, since admins will be used to it.

The reasoning for advanced groupings / ACLs are that suddenly, PunBB can be more than a forum, you could use it for a gaming clan website, where you don't give your clan members moderator status, but they can still view a regularly hidden "Clan members only" forum.

Or for topic ACLs, you could create a PunBB-based Weblog or News/Announcements area and let people reply on only some of the topics, where it would make sense to reply. It's a common blog feature to "disable comments".

Plus, if you didn't trust newer members, instead of giving them full moderator status, you could granularly control the amount you trust them ...

I don't know, maybe I'm just being picky, but I feel something like this is necessary. I can see how using an ACL could make it more complex, sure, but how much would it really slow down PunBB?

  • From: 127.0.0.1
  • Registered: 2001-11-02
  • Posts: 9,167

Re: User groups?

Louis wrote:

Oh fine. I'll admit it, I'd probably use topic ACLs very rarely.

Yeah, stop bugging me and work on the CSS instead :D

"Programming is like sex: one mistake and you have to support it for the rest of your life."

Rickard's Website

13 Reply by Louis

  • Louis
  • Senior Member
  • Offline
  • From: Toronto, Canada
  • Registered: 2003-12-24
  • Posts: 197

Re: User groups?

Louis wrote:

Or for topic ACLs, you could create a PunBB-based Weblog or News/Announcements area and let people reply on only some of the topics, where it would make sense to reply. It's a common blog feature to "disable comments".

Edited my post above. Besides, if we're changing much of PunBB for CSS, it would make sense to do larger security related changes around that time as well ;)

  • From: 127.0.0.1
  • Registered: 2001-11-02
  • Posts: 9,167

Re: User groups?

Here's an updated version of Cactuz's EFAM mod: http://punbb.org/forums/viewtopic.php?id=3263

It'll have to do until 1.2 is released :)

"Programming is like sex: one mistake and you have to support it for the rest of your life."

Rickard's Website

15 Reply by MarcB

  • MarcB
  • Senior Member
  • Offline
  • Registered: 2004-02-13
  • Posts: 124

Re: User groups?

Awww, the whole post gone to hell!!!

Well, here's how I'm doing it now:
I got the original + EFAM, then add a new table that defines groups, and modify EFAM to work instead of with users, with groups. It's much easier, cause I rely completely on the work of others wink . I lose the capability of adding individual users, but I can always create a group with 1 user... then I add/remove groups to forums.

Most of the management is done by hand i.e. I have a pool of 400 initial users, so I assign them directly trough SQL, so I hav no front end for that. If the approach seems interesting, I could try releasing a mod for a mod... hey, I might be the first one to do that wink

Marc

16 Reply by Louis

  • Louis
  • Senior Member
  • Offline
  • From: Toronto, Canada
  • Registered: 2003-12-24
  • Posts: 197

Re: User groups?

MarcB wrote:

... modify EFAM to work instead of with users, with groups. It's much easier, cause I rely completely on the work of others ;) . I lose the capability of adding individual users, but I can always create a group with 1 user... then I add/remove groups to forums.

Rickard and I were talking about that, instead of having both users and groups in this "ACL"-type interface, he suggested just groups ... I agreed because as you said, "[you] can always create a group with 1 user". Interesting if we could incorporate both the EFAM permissions, modified to groups, with a new UI for both ;)

17 Reply by MarcB

  • MarcB
  • Senior Member
  • Offline
  • Registered: 2004-02-13
  • Posts: 124

Re: User groups?

Well, that's fine, modifying the mod is not that hard, however, there's always the problem of adding users to groups... well, maybe that's professional deformation, in my case, all users belong to one group or another, that is, there's one section exclusive for every type of user. So for me to assign the users to groups was easy, I did everything directly through SQL, I'd have to build a front end for that, and for group creation and modification (something else I did lazily ;-).

My other problem, is that I've been going through some security enforcement modifications, mostly encrypting cookies and hiding menus. I've also scrapped the copyright and link from the guest front page, cause I don't want non-users to be able to even see what software is running (that surgical removal was not that easy, since you have to dig deep into the code to find a place where it won't disrupt everything else... it would have been much easier to completely remove the copyright lines, but I've got this thing about giving proper credit...). The point is, I can find the easy lines to be mod, but maybe some subtlety will be lost, so... at this very moment, I can't release this mod. Give me at least a week or so, and maybe I will have something to show up :-)

Marc