Re: Priority of Privileges

On 18/04/07, [email protected] <[email protected]> wrote:
>
> You can for instance insert a subgroup.
> If DenyEditMenu is assigned to a grandfather while ViewEditMenu is
> assigned to a father of the roles you are interested in, then the View
> will satisfy your security checks and the Deny will not come into play.


That's what I expected but it doesn't quite work that way.

I've moved Editors into Members, so I have:
Role: Fred, member of: Editors,Members
Role: Editors, member of: Members

In this situation, the Deny privs in Members overrides the View priv in
Editors.

If I remove Fred from the Members role (so he is just an Editor) then things
work, but I find that less than intuitive.

If I want to make someone an Editor for the weekend I have to add them to
the Editor role, remove them from the Member role, and, after the weekend,
add them to the Member role and remove them from the Editor role.

It would be better if I could simply extend someones privileges by adding
them to a role.


For the less fainthearted there is a switch in the modifyconfig of roles
> (I believe it's been commented out in 1.1.2) that stops DENY privileges
> from being inherited. That would essentially neutralize DENYs unless
> they were directly assigned to a role. Obviously this might have other
> consequences if you use DENYs in other places.


I couldn't find that bit. If you remember the file/line number, I'd like to
take a look at that.

thanx
jalal