Portal Module group permissions (bug?)

[SigiLee]

Hi,

First off, you got a very nice project running here. I was going for phpBB with Wordpress, but that kind of exploded due to the phpBB bridge for WP (security problems, in my personal experience). I think Portal suits the needs of our site better too.

Alright, back to the topic.
Something seems to be going 'weird' with group persmissions for the portal modules. So far I tested it with with 2 module types, but I'm guessing it will be the same for all the other modules. I tested the custom module block (own created one and the default "welcome message" one) and the clock module.

Software at the time of the test:
phpBB v 3.0.9.
Board 3 Portal v 2.0.0b1

For completeness sake:
PHP v 5.3.8
MySQL v 5.5.19

My group memberships on phpBB are: "admins", "global moderators", "registered users" and "members"

The behaviour I expected from the modules would be that if I added 1 of these groups (no matter which one), it would be enough to let the module show up for me. The behaviour was not as I expected , so I did some testing.

Overview of my tests:

Code: Select all

//changing group permissions for module block
*added "members" group:           block not visible
*added "admins" group:            block not visible
*added "global moderators"group:  block not visible
*added "registered users" group:  block visible
*removed all groups 
*added "registered users" :       block visible
*removed "registered users" :     block visible //no groups left, so access for all I'm guessing?
*added "members" group:           block not visible
*removed all groups
*added "global moderators" group: block not visible
*removed all groups
*added "admins" group:            block not visible

//changes in groupmemberships for my account
*removed myself from "registered users" group //which was default group for my account
*made "global moderators" my default group

//changing group permissions for module block
*removed all groups
*added "global moderators" group: block visible
*removed all groups
*added "admins" group:            block not visible

From what I can read from the tests I think I can safely conclude that the group permissions for module blocks only looks at the default group for that member. Is this intentional design or possibly a bug?
According to what I read, the default group has no implications on permissions in phpBB.

In my opinion it is more logical not to take the default group into account in any way when determining whether a user has rights to view content. Or make a setting for turning this behaviour on/off.


Greetings,
SigiLee

[MyLady]

That is my problem too. ( viewtopic.php?f=48&t=4714&p=29424#p29424 )

I have own groups added for some extra things - it works with phbb: some members are in that group, only this members can see some contents, indifferent what groups they are members also. Indifferent, what group is the maingroup. If they're NOT members of the own group, they see nothing.

In Portal it does not work this way - it seems to be inversely, my own groups have no effect in portal. I must add the whole groups.

There are e.g. moderators AND member of the own group family. Or they are registered user and member of own group family. Others are coppa user and NOT in own group and other combinations.. And I don't wish to show membership on private groups to everyone

for portal my own group is without effect.

[SigiLee]

Any wisdom from the development team possible?

Your english is fine btw. MyLady . Besser wie mein Deutsch.

Thanks,
SigiLee

[novanilla]

It seems to me that the group permissions are based on default groups only. It would be a good option to be able to turn this on or off for individual blocks. I like the idea of being able to say: "allow group A but not group B where A and B intersect".

[MyLady]

For information:

after release of 2.0.0 this problems unfortunately still exist. Nothing changed.

If I want to set permissions for a (standard) block just for one special group: isn't possible. Only exception is group Administrators.
If someone is member of various groups, he can not see the block, if he is not in main group for this permission.

###
Zur Information:

Nach dem Update auf Release 2.0.0 stelle ich fest, dass sich dieses Problem bisher leider nicht gelöst hat (habe die github-Version be189ba benutzt). Die Gruppenberechtigungen sind noch immer so, dass ein User einen Block - auch Standardblock - nicht sehen kann, wenn er Mitglied in mehreren Gruppen ist, die Berechtigung für den Block aber nur für EINE spezielle Gruppe gelten soll. Einzige Ausnahme ist die Gruppe der Administratoren.

Es wäre schön, wenn die Berechtigungen da an phpBB angepasst werden könnten. Derzeit scheint die Abfrage oder deren Reihenfolge irgendwie logisch falsch zu sein. Normalerweise kann ich für ein Forum eine Berechtigung einer einzelnen privaten Gruppe erteilen, und keiner kann hinein, der nicht Mitglied ist - unabhängig von seinen sonstigen Gruppen. Das geht im Portalblock leider nicht.

edit://
es hängt davon ab, welche Gruppe als Hauptgruppe eingestellt wurde. Bin ich Administrator und Moderator, meine Hauptgruppe aber ist registrierter Benutzer (weil nicht jeder sehen muss, wer Administratorrechte hat), kann ich den Block für Administratoren nicht sehen... lol
Scheint, als würde die Berechtigung irgendwie mit "NIE"-Einstellungen arbeiten

[bbinary]

This appears to be by design. You will notice that on the menu, permissions function properly. On the main portal, they do not. Here is what I have found:

Code: Select all

portal.php, line 81

        /** 
	* Check for permissions before loading anything
	* the default group of a user always defines his/her permission (KISS)
	*/
	$group_ary = (!empty($row['module_group_ids'])) ? explode(',', $row['module_group_ids']) : '';
	if ((is_array($group_ary) && !in_array($user->data['group_id'], $group_ary)))
	{
		continue;
	}

Code: Select all

portal_main_menu.php, line 72

                // get user's groups
		$sql = 'SELECT group_id
				FROM ' . USER_GROUP_TABLE . '
				WHERE user_id = ' . (int) $user->data['user_id'] . '
				ORDER BY group_id ASC';
		$result = $db->sql_query($sql);
		while($row = $db->sql_fetchrow($result))
		{
			$groups_ary[] = $row['group_id'];
		}
		$db->sql_freeresult($result);

In other words, the main portal looks at the default group of the user to assign permissions. The menu builds an array of all groups. If you use groups other than registered users as your default group, you will need to assign those permissions to the blocks. I found that module permissions apply after adding the appropriate default groups.