Private thread permissions fails to restrict users

[nfeddema]

Private thread permissions fails to restrict users

[rafalp]

This sounds like this user has more than one role, so even when you take away those permissions from them, other permission set still grants them private threads access.

[nfeddema]

No, I just tried again to make sure. I made a new user and immediately created a private thread with that user. I then went into the Admin to make sure that the user was assigned only to the "Member" role, and that the "Member" role is using the permissions defined above. The new user should not have been able to make a new private thread given his permissions.

I am using Misago default settings. I have only created two users and run your "fakedata" script. I am one commit behind your main branch, which was updated 15 hours ago.

[rafalp]

Remember that user permissions come from both their roles and ranks. "Member" rank includes "Private threads" permission set.

[rafalp]

To be fair, this permission system is confusing and I am already planning to change it.

See #1527 for more details.

[nfeddema]

Ah, you are right! Sorry about that.