There were some errors in permissions. With this PR, many permissions tests are added, permissions errors are fixed and a documentation page is added with permissions tables for some user types.
Modifications for old/new permissions can be viewed with the documentation update: @8148874a78ed9738fd79bf5be0a79be4fca1e39a
Note about the "view other on moderation post" update which could seem strange: filter_posts (and topics) ignore on_moderation flag when PREMODERATION is set to False. So old behaviour was to not exclude on_moderation posts. But the may_view test didn't ignore the flag: there was an inconsistency between those 2 permissions tests. The "new" behaviour keep the old one for filtering (on_moderation posts are not ignored if PREMODERATION is OFF) but now, may_view_post do the same. That's why, "view other on moderation post" is now "yes" and was (falsly) "no".
I chose this behaviour to stay the most backward-compatible. This PR mainly restrict perms that users should not do have (isstaff users without permissions) and add consistency between `filterandmayviewor betweenmay_post|deleteandmay_view`.
There were some errors in permissions. With this PR, many permissions tests are added, permissions errors are fixed and a documentation page is added with permissions tables for some user types.
Modifications for old/new permissions can be viewed with the documentation update: @8148874a78ed9738fd79bf5be0a79be4fca1e39a
Note about the "view other on moderation post" update which could seem strange:
filter_posts
(and topics) ignoreon_moderation
flag whenPREMODERATION
is set toFalse
. So old behaviour was to not excludeon_moderation
posts. But themay_view
test didn't ignore the flag: there was an inconsistency between those 2 permissions tests. The "new" behaviour keep the old one for filtering (on_moderation posts are not ignored ifPREMODERATION
is OFF) but now, may_view_post do the same. That's why, "view other on moderation post" is now "yes" and was (falsly) "no".I chose this behaviour to stay the most backward-compatible. This PR mainly restrict perms that users should not do have (isstaff users without permissions) and add consistency between `filter
and
mayviewor between
may_post|deleteand
may_view`.