Restrict 'administer forums' to 'View'able forums

@nbz: The ability to hide the content of some forums from yourself may be a convenience, but it doesn't provide any access control, because if you can moderate a forum, you can take back all the grants whenever you want. The old FA did not let you to selectively allow administering some forums and not others. Anyone with the administer forums permission automatically had full access to all forums. This was an essential missing piece to control access to forum content, and I value it much higher than a convenience feature.

@Frank Steiner: It doesn't need to be the same role that has the 'administer forums' permission and the View grant, at least it's not supposed to be that way. Why would you want someone to administer a forum that they can't view? Or, from the other side, wouldn't you expect those who administer a forum to at least occasionally look inside? So why not explicitly give them access and preserve the ability to NOT give them access?

Wouldn't it be nice to let each research group administer their own forums? but ONLY their own forums?

[...] all the administer forum roles don't have view.

You give them the key, but they're not supposed to open the door and look inside? That's a very very weak strategy... Try to explain that to the members of a very private forum who think they're among themselves only...

Giving someone the ability to administer a forum that they can't view is a paradox. The fact that FA used to allow this was not a feature but rather a bug (well, a not-yet-implemented essential restriction).

I'd prefer not to add an additional grant type to avoid increasing FA's complexity, and I don't see how it would be easier for you to assign Administer grants where needed instead of View grants. Combining administer forums and View naturally results in reasonable access control to the administer page of each forum, without needing an additional grant type.

I see an alternative to combining administer forums and View: combining administer forums and Edit. In fact that was my first attempt: hide the FA controls unless the user has the Edit grant, and keep everything else the same as it was before.

But actually, following the Drupal way, I'd like to be able to remove inaccessible forums from sight. However, I'm afraid that hiding some forums might cause problems with the drag&drop reordering of the forums on the admin/content/forum page. So, at least the forum titles need to remain visible on that page.

In the end a straight-forward strategy seems the simplest: allow access to those who can view, and don't allow access to those who can't view (with the compromise mentioned above).

@nbz: Try hovering your mouse over the role. That should give you an explanation.

Tell us what it says and whether it makes sense. Maybe the conditions are too broad...

Finally, for the forum that I did not want to see, the core cabal has all boxes ticked in there, but that is not enough to see it - I also have a separate role which only allows its members to see and post in it and the people with that permission can see it.

I don't quite understand what you're saying here.

The general idea is that a role with the administer nodes permission can see and do everything anyway, so it does not make sense to try to take away any grants from that role.

(Likewise, roles that don't have access content are permanently OFF.)

I understand your reasoning, but it would be the exception to the rule, not the other way around, as you present it.

Take access content: you need access content AND View to see nodes. Without View, nothing goes.

Take create forum topics: you need create forum topics AND View AND Post to be able to post.

Now when someone adds a forum he must think of giving the view permission to all those other roles, because initially all view permissions are off for every role to be sure that none content is ever provided accidentally.

If your main goal is to never provide content accidentally, then you should be in favor of not providing content to anyone who hasn't View access! Requiring to "think of giving the view permission to all those" who are allowed to have it is exactly what you want!

The problem is administer nodes — this is an all-powerful permission that's used by all sorts of modules to provide access to all nodes. It's just not realistic to try to override that. administer forums OTOH is not such a beast, it can be domesticated.

Oh, BTW, adding View to your administer forums roles in all existing forums is just a simple SQL statement and a permissions rebuild, if that's really your intention.

Thanks! :-)

Just to provide some additional perspective, the following lines are from the core node_access() function:

  if (user_access('administer nodes', $account)) {
    return TRUE;
  }

  if (!user_access('access content', $account)) {
    return FALSE;
  }

After this, node_access() asks the module that defined the content type, and only if that module neither denies nor grants access does node_access() turn to the {node_access} table. Without any "node access" module there's a universal View grant in place. Install any "node access" module, and that universal View grant disappears and it takes a specific View grant to have access to a node.

This is from forum.module:

function forum_access($op, $node, $account) {
  switch ($op) {
    case 'create':
      return user_access('create forum topics', $account) ? TRUE : NULL;
    case 'update':
      return user_access('edit any forum topic', $account) || (user_access('edit own forum topics', $account) && ($account->uid == $node->uid)) ? TRUE : NULL;
    case 'delete':
      return user_access('delete any forum topic', $account) || (user_access('delete own forum topics', $account) && ($account->uid == $node->uid)) ? TRUE : NULL;
  }
}

There's no grant_create column in the {node_access} table, and node_access() will turn the 'create' NULL into a FALSE. That's why create forum topics is needed, and we can only restrict it by taking away forums, where the user doesn't have the Post grant.

With update/delete, if forum_access() returns TRUE, the user can do it. If it returns NULL, the {node_access} table is consulted, i.e. if the user has an Edit/Delete grant, he can do it.

IOW, View and Post are ANDed, Edit and Delete are ORed with their respective permissions, but they all require access content and View. All this is defined by the core "node access" mechanism, not by Forum Access.

Subjecting administer forums to View as well is consistent with the existing pattern. Not doing this in D5 was not a feature but a weakness.

@nbz: Please reopen if your #5 is still pending...