Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Clone this wiki locally
Privileges can be assigned to Groups, Persons and magic assignees, like 'EVERYONE', 'ANONYMOUS' or 'USERS'. The MidCOM DBA method
get_class_magic_default_privileges can be used to set default privileges for all objects of a DBA type.
By default, the following privileges are available:
Midgard Core Privileges
- midgard:read controls read access to the object, if denied, you cannot load the object from the database. This privilege is granted by default.
- midgard:update controls updating of objects. Be aware that you need to be able to read the object before updating it, it is granted by default only for owners.
- midgard:delete controls deletion of objects. Be aware that you need to be able to read the object before updating it, it is granted by default only for owners.
- midgard:create allows you to create new content objects as childs on whatever content object that you have the create privilege for. This means you can create an Article if and only if you have create permission for either the parent Article (if you create a so-called 'reply article') or the parent Topic, it is granted by default only for owners.
- midgard:parameters allows the manipulation of Parameters on the current object if and only if the user also has the midgard:update privilege on the object. This privileges is granted by default and covers the full set of parameter operations (create, update and delete).
- midgard:attachments is analogous to midgard:parameters but covers Attachments instead and is also granted by default.
midgard:autoserve_attachment controls whether an Attachment may be autoserved using the
midcom-serveattachmenthandler. This is granted by default, allowing every attachment to be served using the default [MidCOM URL Method](MidCOM URL Methods). Denying this right allows component authors to build more sophisticated access control restrictions to attachments.
- midgard:privileges allows the user to change the permissions on the objects they are granted for. You also need midgard:update and midgard:parameters to properly execute these operations.
- midgard:owner indicates that the user who has this privilege set is an owner of the given content object.
MidCOM Core Privileges
- midcom:approve grants the user the right to approve or unapprove objects.
midcom:component_config grants the user access to configuration management. Components implementing these screens must check this privilege manually, while the
midcom_baseclasses_components_handler_configurationbaseclass does this implicitly when accessing the config screen (you still need to control toolbar links yourself), it is granted by default only for owners.
- midcom:isonline is needed to see the online state of another user. It is not granted by default.