WoltLab/WCF — Issue #379: Groups and permissions
Author: ThiefMaster
Created: 2012-01-15 13:47:54+00:00
State: open

Even though this would be a rather huge change and thus unlikely to be done, I'll suggest it anyway since I think it's worth some thoughts/comments - and maybe I'm not the only one who thinks it would make things much nicer:

Right now every group, even a newly create one, gives users various permissions; let's take "attachment filetypes" as an example. If you now create a group to just grant access to some forums, this group will have values for the various permissions, too. So, if you removed some filetypes from "registered users" and/or "everyone", you need to remember to do that for newly created groups, too. If you have lots of groups that are just used to grant access to some forums - which is a pretty likely case if you have large internal areas which belong to various groups who aren't allowed to see everything - this gets rather messy.

Things would be much easier if a group by itself had **no permissions at all**. So by default, adding a user to a newly created group would not change anything for him. You could then just grant some forum-specific permissions to that group and thus easily give them forum access without affecting any other privileges.
For adding other privileges to a group, you could choose them from a list and then add only those you actually want. If you had e.g. a group for "trusted users" who should be able to upload any file types, you'd only grant the "allowed attachment filetypes" privilege to them and put * in the list.

By making privileges addable separately, you could also add more fine-grained options:

* **Default**: This would initially be only set for the privileges of the default groups such as "Everyone" and "Registered Users". Having this flag on a privilege would make any group with the same privilege set override the default value, no matter if that adds or removes a privilege from the user.
* **Merge**: This would be used mainly for list values. By enabling it, any values given in the list would be merged with the lists for the same privilege in other groups the user is in, resulting in the same behaviour as the current WCF has. For non-list values it shouldn't be available at all.
* **Override**: This flag would make the permission take priority over the same permission from other groups, i.e. just as if it was flagged as "Default" in all other groups. Some "Override if ..." sub-options would make sense: "always", "if value is bigger" and "if value is smaller" so you can actually have a group that sets a numeric privilege (e.g. attachment filesize) but never overrides a better/worse value (so if that group was used as a kind of punishment, you wouldn't want it to override an even lower value but otherwise you would want it to overwrite lower values)
* **All Forums**: This flag would be used for forum-specific permissions. Setting it to "Yes" would grant that permission on all forums, setting it to "No" would not grant the permission at all unless enabled in the forum-specific permissions. When adding group permissions to a forum you could then choose between "Inherit from group" which would grant the "All Forums == No" permissions from that group in the specified forum and "Specify manually" where you could add specific permissions for that forum which might differ from the default permissions of the group".

To avoid confusion with "override always" groups, the group lists of users would have to be sorted. On top there would always be the default groups "Everyone" and "Registered Users", any other groups would be sortable via Drag&Drop. This would allow people to have e.g. an "Annoying People" group that would remove some permissions and put this group at the very bottom of the list, ensuring the "Override all" privileges from that group are always used and not overridden by another group.

With all those changes there should also be a new option when setting forum privileges for a group: "Inherit to sub-forums". Setting this to "No" would make it much easier to grant access to a specific subforum in a category without having to revoke access to every other forum in that category manually. You'd simply grant the "Can see/enter forum" privilege to the category *without* inheritance and then also grant the necessary privileges to the subforum you want the group to access. With the current inheritance you have to set explicit "No" permissions on all other forums in that category - and of course chances are good you forget to do so when adding a new forum.

---

These changes would make the group system much easier to use but at the same time more powerful. Especially in big forums it would make the administration much less error-prone and faster.