[CDB] [forum permission] Allow viewing topics started by others

[brunoais]

OK, thank you. More people testing would be quite good too.

[qarclas]

Sooooo disappointed to see that it wont be ready / working in 3.1.3

I know it's not the author's fault but now I have no ETA for fixing issues we have on our board from the 3.1 upgrade.

back to 3.0 we go!

[brunoais]

back to 3.0 we go!

Good luck. See you when the extension is ready, then

[heinrich_k]

I'd not tie the visibility of a topic to user who posted the first message in the topic, but that in fact all users who have posts in a given topic should be able to see it, as well as those having the permission to do so.

This makes a difference when topics are merged, divided or the author of a post is edited by a mod.


Therefore the permissions should probably read:

• Can view topics with posts written by user
• Can view topics with no posts written by user

[brunoais]

You mention a lot but you don't mention the "why".
Why is that a better than the original intent of this extension?

[leschek]

Therefore the permissions should probably read:

Can view topics with posts written by user

But how user will write his/her first post into topic if this permission apply. In other words user will not see it, because he/she didn't write a post there yet.

[heinrich_k]

The reasoning is this:

If only the first poster (and those in a special group) would see the topic I could not use it for mediation as follows.
If any poster with a post in the topic could see the topic, I as a moderator, could post a short message, change the author to whomever I want to see the topic too and would have a topic that two users and those in a special group can see. That is really super for mediations of any kind.

Same when in any other part of the board there is a kind of argument, that goes off-topic. I can just divide that topic and move the undesirable parts to this special forum and sort it out with those involved without having the original topic spammed with off-topic mediation posts.

That's why "Anyone who has posted in the topic can see it" (and those with permissions) makes more sense then "The first poster" (and those with permissions).
It is mightier. However, it would behave the same way, unless a mod manipulated the topic (by moving, merging or changing authorship of posts).

Therefore I would have much more use for this approach and it also wouldn't hinder the original intent of the new permission system.

[leschek]

OK. Thanks for explanation. That makes sense.

[brunoais]

I think you got the idea wrong here.
That use-case is not part of what I'm trying to apply here.

The use-case I'm enabling by doing this is: user A wants to discuss something to/with groups B, C, D, etc... (predefined by the admin)
Your use-case is slightly different. Your use-case is to allow a volatile (ad-hoc) group to speak with groups B, C, D, etc...

Both are different use-cases and defining a solution only based on whoever made a post on the topic due to post moving is a mechanic that is too hard for most users to grasp (past experience talking).
That also rises questions such as:

• How are the topics' posts gathered such that the permissions are properly selected?
• How are the posts made so that they are moved to the proper topic?
• Can any user make a post on any topic even if he can't access to read it? Does that mean that anyone can access any topic as they can just make a post on all topics?
• Should happen if the only post with user X is or is required to be deleted in the topic (for any reason besides banning the user from that topic)?
• What if you just want user Y to be in the topic as a CarbonCopy and not as a full participant? Does he have to have a post there just "because"?
• Does it make sense to a user that a topic that he didn't know to exist suddenly appears on a topic list which he didn't make?

That's just a small problems list I created just now. It is not a bad idea for a thing but it has to be more than just a new permission.
Giving rights based on all participants is also a really, really bad idea performance-wise. It would be best if the access to the topic was invite-only or something like that. That would be a job for a different extension and, definitely, not as just as a new permission (interface-wise)

[heinrich_k]

The use-case I'm enabling by doing this is: user A wants to discuss something to/with groups B, C, D, etc... (predefined by the admin)
Your use-case is slightly different. Your use-case is to allow a volatile (ad-hoc) group to speak with groups B, C, D, etc...

True.
However the use-case I described encompasses the use-case you described.

I feel that, if you create a extension that does what you are describing there will inevitably be the question "if I can do it for user A, can I do it for user A and B"?

The questions you posted are good, and I have answers for them, that I think are intuitive.

Surely, it is a system not every one needs and wouldn't be used on most boards, probably. But, it would still be a huge help for those who (like me) who need it.

How are the topics' posts gathered such that the permissions are properly selected?
All topics are displayed, with at least one post in them by the user.
I'm not sure how a SQL command for that would look like, but I'm sure a Sub-Query could manage that.

How are the posts made so that they are moved to the proper topic?
As they are made now. You enter into a topic and click the 'Reply' button.

Can any user make a post on any topic even if he can't access to read it?
No, a user should be unaware of any topic that he can't access - therefore he can't add posts to it.

Does that mean that anyone can access any topic as they can just make a post on all topics?
No, that would betray the purpose.

Should happen if the only post with user X is or is required to be deleted in the topic (for any reason besides banning the user from that topic)?
The user wouldn't have access to the topic anymore, as it would not show up in the forum listing.
Surely the permissions need to be re-checked in the viewtopic.php so that one couldn't enter a topic by manipulating the url to enter topics not on the forum listing.

What if you just want user Y to be in the topic as a CarbonCopy and not as a full participant? Does he have to have a post there just "because"?Yes. If for some reason user Y should be able to access the topic and is not in the predefined group then a mod would need to create one post on user Y's behalf in the topic, to grant access.

Does it make sense to a user that a topic that he didn't know to exist suddenly appears on a topic list which he didn't make?That depends on the circumstances.
But that isn't any different than changing the permissions in the Administration Panel.
I mean if I pick a random user and add him to a group with more permissions for no reason that user might at his next visit see a lot of new sub-forums.
Is that confusing? Maybe. But usually I tell people that I will change their groups/permissions.

Giving rights based on all participants is also a really, really bad idea performance-wise. It would be best if the access to the topic was invite-only or something like that. That would be a job for a different extension and, definitely, not as just as a new permission (interface-wise)

Well, I requested a extension and was made aware of this topic.
That said, I can see, that it might be a problem performance-wise in regards to the database, when listing all topics in a forum.

If one had an option, when posting in a special type of forum, that would allow to choose "This topic is hidden to all but ..." it would need additions to tables and a change in the board interface. That seems like a lot work.

[brunoais]

Ask that here: viewforum.php?f=496

Feel free to link back here. I can give some assistance for such extension author.
Something similar has been suggested but I'm not sure by whom.
I may add that to my ToDo list for phpBB and I'll probably pick it up if no one else does it.
Anyway, what you are suggesting is not this extension and this extension will not become that. That's final.

[Sshadow]

I understand you need some implementations to the core phpbb software to fully make this work however can you give an update as to the state of this currently?

My "use case" I have in mind. I set up a forum where people can create a thread applying for a position. I will be using a separate extension to create a sort of "form/template" in their post they will fill out. I only want say one or two groups on my forum to have access to these threads besides the OP of course.

Am I correct in my understanding of the purpose of this ext? Is it useable at all yet or is it necessary to wait till 3.1.4?

[brunoais]

All non-event code changes are already merged to 3.1.3. The problem is that there are 2 events missing in 3.1.3. Although it is still possible to have the basic work of the extension, there would still exist 2 security holes that could be explored by an attacker.

That's one of the use-cases that I predicted this to be used for .

Once it is done, it will be usable with 3.1.3 but there will be security holes. Use it at your own risk.

[qarclas]

any ETA on the 3.1.3 release (aware it will have security holes)

Also to clarify, have been reading the posts above and want to make sure it actually does what I want it to.

note: I don't know which is a topic, a thread or what terminology to use.

We have a thread on our forums for new applications for joining our group.
This thread is visable by our current members. All posts.
Only the announce posts at the top should be visable by new registered users and any new posts they make.

eg. If 9 new people register on the forums and make a post in this thread, they should only see their OWN post and the announce posts at the top. Not the other 8 posts from other new users.

Is that how it can be configured to work?

[MastaSukeh]

Is there a way to manage this permission per thread?
As in default for forum is that no one except the creator and admin/mods can see it, but if we want so that someone else can see this specific thread per their involvement?