Re: Priority of Privileges

You can for instance insert a subgroup.
If DenyEditMenu is assigned to a grandfather while ViewEditMenu is 
assigned to a father of the roles you are interested in, then the View 
will satisfy your security checks and the Deny will not come into play.

For the less fainthearted there is a switch in the modifyconfig of roles 
(I believe it's been commented out in 1.1.2) that stops DENY privileges 
from being inherited. That would essentially neutralize DENYs unless 
they were directly assigned to a role. Obviously this might have other 
consequences if you use DENYs in other places.

Marc