Problem/Motivation
The primary use of Forums is on community focused sites, the majority of Forums will require some level of Access Control on a per-forum basis.
For example a typical community forum will have:
- Forums that anyone can interact with and view, for example a General Discussion forum
- A community will then usually have some kind of announcement focused forum. For these forums everyone will usually be able to view and comment on topics, but the ability to post new topics will be limited to users with a specific role.
- A typical community will then also have private forums, for example a Staff Discussion forum. These forums will usually be completely inaccessible to anyone who doesn't have a specific role.
The current way to accomplish this in Drupal is to use a contributing Access Control module (a popular choice for Drupal 7 sites has been
Forum Access →
) however relying on contributing modules to provide this functionality does not seem like a good forward thinking idea, given that this feature is such a critical requirement for most forums. Requiring a contributing module to provide this functionality poses risks, the main one being that if the contributing module stops being maintained it could be a barrier to many forum based sites updating between major versions of Drupal, for example the Forum Access module has still not updated to Drupal 8.
Proposed resolution
- Add per-forum Access Controls to the core Forum module.
- Ability to set CRUD (Create, Read, Update, Delete) level access for each role
Remaining tasks
- Decide how inheritance should work as that is currently unclear
- Decide if access should just be per role or if it should also be possible to set per user
- Agree on any other additional ACL settings that should be implemented, such as the ability to control if the forum is visible in forum lists or not and who can and can't comment
- Investigate and agree how post counts and other statistics should be handled, especially if the forum is visible on forum lists but not actually accessible
- Write and test patches for an MVP
- Investigate and discuss a possible migration for Forum Access and Taxonomy Access Control
User interface changes
On the Forum Edit form add a section for setting the access controls.
API changes
Data model changes
Original report
Private forums meaning
- Forums can be private or public.
- Private forums are completly invisible for those who can not access them. For example, no direct need to provide a block that tells anonymous users about the existence of private forums. Private forum threads do not show up in trackers, content listings etc. if you don't have access to them.
- We want a flag of some kind which turns on CRUD on a per-forum basis for people with access to it. (If you need something fancier, use TAC)
---
initial post:
The two biggest feature requests for Drupal forums are:
1. Making it look like a PHPBB-esque forum
2. The ability to have private forums
#1 is a theme issue, and I do not care to address that one.
However, #2 is something that would be immensely valuable, no matter what you want your forum to ultimately look like. And! Now that node access arbitrator is in core, the time seems ripe to tackle this (with what? a week left of the code freeze? plenty of time! ;)).
merlinofchaos has pointed out that the forum access module attached to the original node access issue: http://drupal.org/node/75395#comment-118829 would be a good place to start.
