Details
-
Type:
Bug
-
Status:
Closed
-
Priority:
Major
-
Resolution: Fixed
-
Affects Version/s: 1.8.2
-
Component/s: Roles / Access
-
Labels:None
-
Affected Branches:MOODLE_18_STABLE
-
Fixed Branches:MOODLE_19_STABLE, MOODLE_20_STABLE
Description
The authenticated user role seems to have fewer rights than the guest role, which can't be right surely?
Example: mod/forum:viewdiscussion is allowed in the guest role but not in the authenticated user role.
Issue Links
| This issue will help resolve: | ||||
| MDL-8724 | "Site New" items don't appear on the front page when logged in as a student or teacher. |
|
|
|
| MDL-9915 | authenticated user has less privileges than a not logged in user |
|
|
|
| This issue will be resolved by: | ||||
| MDL-11143 | Add a new setting "defaultfrontpageroleid" where you choose a role for all users on the front page course |
|
|
|
| This issue has been marked as being related by: | ||||
| MDL-11143 | Add a new setting "defaultfrontpageroleid" where you choose a role for all users on the front page course |
|
|
|
Hi Howard,
I think this is correct. Giving mod/forum:viewdiscussion to guests only lets them view the site course forums, and whatever course that's open to public. Guests needed this to see open forums posts. Actions guests can perform are actually very much restricted by require_login().
If this is applied to authenticated user, logged in users can see all posts in courses that they can access, unless it's set as prevent or prohibit explicitly (which might or might not be what you want), as this applies to the system context. Users normally do have a secondary role in relevant contexts which should specify whether mod/forum:viewdiscussion is allowed.
Cheers,
Yu