Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.Problem/Motivation
The primary use of Forums is on community focused sites, the majority of Forums will require some level of Access Control on a per-forum basis.
For example a typical community forum will have:
- Forums that anyone can interact with and view, for example a General Discussion forum
- A community will then usually have some kind of announcement focused forum. For these forums everyone will usually be able to view and comment on topics, but the ability to post new topics will be limited to users with a specific role.
- A typical community will then also have private forums, for example a Staff Discussion forum. These forums will usually be completely inaccessible to anyone who doesn't have a specific role.
The current way to accomplish this in Drupal is to use a contributing Access Control module (a popular choice for Drupal 7 sites has been Forum Access) however relying on contributing modules to provide this functionality does not seem like a good forward thinking idea, given that this feature is such a critical requirement for most forums. Requiring a contributing module to provide this functionality poses risks, the main one being that if the contributing module stops being maintained it could be a barrier to many forum based sites updating between major versions of Drupal, for example the Forum Access module has still not updated to Drupal 8.
Proposed resolution
- Add per-forum Access Controls to the core Forum module.
- Ability to set CRUD (Create, Read, Update, Delete) level access for each role
Remaining tasks
- Decide how inheritance should work as that is currently unclear
- Decide if access should just be per role or if it should also be possible to set per user
- Agree on any other additional ACL settings that should be implemented, such as the ability to control if the forum is visible in forum lists or not and who can and can't comment
- Investigate and agree how post counts and other statistics should be handled, especially if the forum is visible on forum lists but not actually accessible
- Write and test patches for an MVP
- Investigate and discuss a possible migration for Forum Access and Taxonomy Access Control
User interface changes
On the Forum Edit form add a section for setting the access controls.
API changes
Data model changes
Original report
Private forums meaning
- Forums can be private or public.
- Private forums are completly invisible for those who can not access them. For example, no direct need to provide a block that tells anonymous users about the existence of private forums. Private forum threads do not show up in trackers, content listings etc. if you don't have access to them.
- We want a flag of some kind which turns on CRUD on a per-forum basis for people with access to it. (If you need something fancier, use TAC)
---
initial post:
The two biggest feature requests for Drupal forums are:
1. Making it look like a PHPBB-esque forum
2. The ability to have private forums
#1 is a theme issue, and I do not care to address that one.
However, #2 is something that would be immensely valuable, no matter what you want your forum to ultimately look like. And! Now that node access arbitrator is in core, the time seems ripe to tackle this (with what? a week left of the code freeze? plenty of time! ;)).
merlinofchaos has pointed out that the forum access module attached to the original node access issue: http://drupal.org/node/75395#comment-118829 would be a good place to start.
Comments
Comment #1
Liam McDermott CreditAttribution: Liam McDermott commentedComment #2
bsherwood CreditAttribution: bsherwood commentedRetagging. +1 on this in Drupal 8!
It just seems doubtful this will make it in D7.
Comment #3
yoroy CreditAttribution: yoroy commented"Major" as in should have (where normal is a nice to have). Saving critical for later :)
Comment #4
MichelleA definition of "private forums" would be a good place to start. Forum access isn't a simple issue and it needs to be decided just how complex you want to get in core. Some food for thought:
Michelle
Comment #5
multitaskma CreditAttribution: multitaskma commentedMaking the appearance look like PHPBB not major IMO, but private forums has my vote as it would extend functionality and help to build a community with senior members.
Comment #6
webchickBasically, I mean private forums as someone coming from PHPBB would understand them, which to answer your questions means...
Should it allow some forums to be private and others not?
Yes.
Should private forums be completely invisible?
Yes.
Should private forums show the topic titles but not the topic content?
No? That doesn't sound very private to me...
If the other issue about only showing so many levels deep gets in, and there are aggregated stats on the forum page, need to exclude private forums.
[Edit because this was unclear] Yes. Well. People who could see a private forum with 50 posts in it would see an extra 50 posts, people without access would see the count, less 50 posts. Same as pagers, etc. elsewhere in Drupal.
Do you want to control access to CUD as well on a per forum basis?
[Edit because this was unclear] No, we don't want to track these permissions separately. We want a flag of some kind which turns on CRUD on a per-forum basis for people with access to it. If you need something fancier, use TAC.
Comment #6.0
yoroy CreditAttribution: yoroy commentedfirst stab at summary
Comment #7
yoroy CreditAttribution: yoroy commentedAdded humble beginnings of a summary of this.
Comment #8
MichelleThe bit about showing titles only is actually a common feature request. It makes the forums a bit of a "teaser" that people have to sign up to get the rest of. Not saying it has to be in core or anything. Just trying to help out by putting up the "things to think about" that I've run into with my forum work.
The aggregated bit wasn't meant to be a question. :) Just a reminder that that would need to be kept in mind.
Michelle
Comment #9
Wim LeersComment #10
salvisNot sure why this issue is still open. The Forum Access module was published by merlinofchaos about 7 weeks after this issue was created, and it has worked fine ever since.
I doubt this will ever get into core.
Comment #11
webchickIf we keep forums in core in D9, this is pretty standard expected behaviour.
Comment #11.0
webchicksummary tweak
Comment #12
mgiffordPretty much every time a client asks us for a forum, they also want a private forum. It's something that folks have somehow learned to expect from other systems I think.
Comment #13
catchStruggling with this being major.
Comment #14
webchickUnless I'm mistaken, I don't think there's anything that precludes this happening in a minor release.
Comment #19
AaronMcHaleI'm going to "kick the bucket" so to speak on this again.
As others have mentioned here (and I myself have experienced) the ability to have "private forums" seems to be required by enough people and enough use cases that it just make sense to include this feature as part of the core forum module. Given that this feature is a fundamental requirement for most forum setups it is to risky to leave this up to a contributing module such as Forum Access (which still has no D8 Development yet preventing forums which require access controls from updating).
I think it's obvious though what ultimately we are talking about is per-forum access control on the CRUD level, as anything more or less would not satisfy all or enough use cases relative to the work required to implement this. As such I've updated the original issue to reflect this, as the term "private forums" also seems too ambiguous.
For anyone interested please discuss the points under the "Remaining tasks" heading
Comment #20
dillix CreditAttribution: dillix commentedI also think that it should be a part of core. And we should create migration from forum_access
Comment #21
AaronMcHale@dillix yes it would definitely make sense to have a migration path, possibly from Taxonomy Access Control as well since that was also quite a popular choice. Updated the Remaining Tasks section with migration in mind.
Comment #22
dillix CreditAttribution: dillix commentedMany people use forum_access in D7, so it should be migration path from forum_access also.
Comment #33
quietone CreditAttribution: quietone at PreviousNext commentedForum is approved for removal. See #1898812: [policy] Deprecate forum module for removal in Drupal 11
This is now Postponed. The status is set according to two policies. The Remove a core extension and move it to a contributed project and the Extensions approved for removal policies.
It will be moved to the contributed extension once the Drupal 11 branch is open.