This post originated from an RSS feed registered with PHP Buzz by Forum One. Original Post: Default Record privileges Feed Title: Syntax Framework Feed URL: http://blog.syntaxcms.org/rss.php?version=0.91 Feed Description: Finally, a place to answer Syntax questions Latest PHP Buzz Posts Latest PHP Buzz Posts by Forum One Latest Posts From Syntax Framework

Syntax CMS has a flexible records privileges system in place that controls what users and groups can read and/or write a particular data record. As long as you use the pxdb_collections class to retrieve data, the appropriate sql and checks are added automatically. Through the Access Privileges tab in the Admin application, you can manually specify what groups can have read and/or write access to a specific record. For example, you could have a 'registered users' group that will have access to embargoed content on your site. To make sure only a logged in user in that group can see that record, you'd remove read access for the 'Everyone' group, and give read access to the 'registered users' group. On the front-end, Syntax CMS would take care of showing that record, in any collection or on a detail page, only to the 'registered users' group.

But, Syntax also assigns privileges automagically by default whenever a new record is entered. Here is how:

1. The 'Everyone' group gets read privileges.
2. If a user is logged in, then that user gets both read/write privileges to a record.
3. The group id specified in the pxdb preference 'gid_admin' gets read/write privileges

This works fine most of the time. It'd be nice to have more control, maybe at the content type level, over if Everyone gets read access automatically or to specify additional groups that should get default read/write access to a content types's records.

Update: currently, only the admin group can see the 'Access Privileges' tab in the Admin application. Maybe we need to add a 'set_privileges' datatype priv and use that to test if a group can modify the record privileges.

To clarify, Syntax CMS has two levels of privileges. Datatype privs define what a group can do (add|edit|delete|approve) with a specific type of content ( ie documents|links|events). Record privs define what a user or group can do with a specific instance of a content type ( the link to Google, the Annual Conference event, and so on ).