[2.0] Global Mod can modify and remove Admin Posts

[nimda]

Thanks emanuele,
I have found it 

[kat]

Duplicate post, too...

http://www.simplemachines.org/community/index.php?topic=480274.msg3361408#msg3361408

...which had to be removed from the FAQ topic.

Weird, or what?

[Elmacik]

I support the idea that it works as intended. But what about this different approach: we always say that "you shouldn't give these permissions to people you don't trust"; OK, so do we ever expect a trusted moderator remove an admin? That's a little bit paradox. Because if the global mod is never expected to delete an admin, then why he can?

[Kindred]

Elmacik, it's not about removing an admin account.... it's about removing or editing admin POSTS

and setting a flag on a post to say "this is an admin post, only other admins can remove it" seems like a waste of processing.

[Arantor]

In any case, even users who have the ability to manage membergroups can't remove an admin account without being an admin themselves.

I can see both sides of the argument, but I think I'm inclined to agree that global moderators should just be able to globally moderate - posts.

[Elmacik]

Elmacik, it's not about removing an admin account.... it's about removing or editing admin POSTS

and setting a flag on a post to say "this is an admin post, only other admins can remove it" seems like a waste of processing.

Yeah I know, some people also mentioned global mods removing admins. Either way, I agree that modfying posts permission should not exclude admin posts. And as Arantor stated, new behaviour is global mods can't remove admins unless the admin specially gives the permission to manage forum (which is actually making the mod an admin practically).

[Arantor]

And as Arantor stated, new behaviour is global mods can't remove admins unless the admin specially gives the permission to manage forum (which is actually making the mod an admin practically).

Not quite. It's not actually admin_forum.

As of RC4, groups can be set to protected, which means one can only remove that group from another user if the person performing the action is either proper admin (group 1) or belongs to that group and also has manage-membergroups permission.

It also can't be assigned in a similar fashion.

[Elmacik]

Admins (group 1) do automatically have all the permissions including manage-membergroups. Plus, any membergroup can have the manage mamabergroups permission that admin may decide; will be able to manage members and the groups. That's why I said as you stated, SMF has changed the default behaviour, which previously allowed any member group that has the permission delete the admin accounts.

[Arantor]

I was just confirming when it happened, but before RC4, I thought only group 1 users could add/remove group 1, it was more the case that you could create a group with all permissions that would not be so protected.

[Arantor]

This is, ultimately, not a bug. It is as designed and I'd argue that the reverse is actually less obvious in terms of how it works. Especially if you want to have the situation of a moderator/admin posting a topic that needs to be updated regularly... this isn't something you can readily do particularly well outside of 'all or nothing'.

The problem with implementing such protected posts is that you then need to consider multiple levels of protection... what if you have a global moderator post, can that be edited by board moderators? etc. etc.