Permissions Overview

glFusion has a very flexible method of controlling access to content, plugins, and features. Almost every component of glFusion has the following security attributes associated with it:

• Owner Permissions
• Group Permissions
• Logged-In User Permissions
• Anonymous Permissions

Each permission can be set with the following attributes:

• Write
• Read
• None

There is one exception, the Owner permission is always Read and Write.

For example, if you wanted to have a story that could only be viewed by paid subscribers to your site, you could do the following:

• Create a new group called ‘paid_subscribers’
• Add site users to the group
• Set the group for the story to ‘paid_subscribers’
• Set the permissions on the story to:
  • Owner – Read / Write
  • Group – Read
  • Logged-In Users – None
  • Anonymous – None

Now, only the owner (the author) and members of the ‘paid_subscribers’ group can see this specific story.

In some cases, glFusion’s security permissions follow a hierarchy. For example, a story belongs to a Topic. Topics have their own security settings. Even if a story has permissions that would allow anyone to see it, it is possible that the Topic’s security permissions would restrict access to the story. glFusion uses the least privilege model, which means when there are multiple levels of permissions, the least permissive setting wins.

glFusion has several pre-defined groups, these include:

You can also create new groups to support your access requirements.

glFusion has an additional security feature called Rights. Rights are generally associated with an administrative function or a feature of the system. For example, there is a right called story.edit. If this right is assigned to a group, then members of that group could edit stories on your site.

Here is an example of how Rights can be used: If you have a site where you have delegated some responsibility for administration to some of your trusted users, you might create new groups to support the delegation of duties. For example, if you have 3 users who will moderate new story submissions (review and either approve or reject submissions), you could create a group called story_moderators and assign that group the right story.moderate. Any member of the story_moderators group can now moderate stories on your site.

There are several pre-defined rights: