By cantthinkofanickname on
I have created a user type called member and not allowed any rights except comments. I have cleared the cache and done the php update. When I log on as that user I get the Create Content menu item (and View/Edit in the heading) and can proceed from there.
I want a class of member who can post comments whilst we get our site agreed.
How do I prevent this?
Comments
Hi Does the role
Hi
Does the role 'authenticated user' have any rights to create content? Any permissions granted to 'authenticated user' will cascade to other created roles. The best way to get around this is to only create roles that supersede access rights on the 'authenticated user'.
I hope this helps
---
I confirm what reported by danmurf; the permissions given to the authenticated user are used for all the authenticated users, even if they have another role too.
If you want to create a role that is only allowed to add comments, you must create two roles: one is the role member you already have, and one is a role for all people who don't have that role; remove the permission to create content from the authenticated user, and add it to the second role you create.
Basically what everybody is
Basically what everybody is saying is that authenticated user needs to be the least permissive role (other than anonymous user of course). If every role has some permissions that another role lacks, then authenticated user will be a dummy role with all those permissions taken away.
Thanks, I have set
Thanks, I have set authenticated to not allow access to the FCK editor and made my "Member" role the same and now when I logon as a "member" I see I cannot edit any documents.
When I put in others who can edit documents, how can I restrict them on a per document basis?
Where to go from here....
Hi
Here's the thing about Drupal, and this is probably true for all Content Management Systems BTW, there are many ways of achieving your stated goal, perhaps it is as simple as the ACL module.
That being said, perhaps the problem isn't being stated well enough, do you know exactly what you are trying to do?
Do you want to share editing amongst a predetermined group of people?
Do you want to share editing amongst an ad-hoc group of people?
Do you want to restrict editing to just one person per document (the owner)?
Do you want different documents to have different access rights?
Do you want to restrict viewing of any documents?
Do you want to have a combination of the above?
Drupal is highly extensible and can achieve all of the above implied functionality and more with the correct combination of modules, in fact there are likely many ways to achieve most of the above, the Right Way(tm) depends on your requirements. Were I you, I'd spend some time thinking hard about exactly what your permission model is, and write it down as a set of requirements. Something like:
1) A member MUST be able to restrict editing of documents they own
2) A member SHOULD be able to restrict viewing of documents they own
3) The administrator MUST be able edit all documents
...
Once you have the set of requirements then it is fairly simple to find the modules you require, so simple in fact that you can do it yourself by searching from http://drupal.org/project/Modules page using keywords from your requirements to guide you.
Hope this helps....I went through much of this process myself over the past few months and built out a site that provides all of the following types of content: public viewable, private predetermined shared, private ad-hoc shared, private -> public promotion, and even some content types that integrate public and private content together. As a community building platform, my requirements were quite broad and my solution uses many distinct modules (but no custom code). Yours might prove to be much less complex.