SMF uses an "inclusive" permissions system. This means that are normally "additive". If a member belongs to two membergroups, and at least one of them is allowed to do something, then that member will be allowed to do that, even if the other membergroup is not allowed to do that thing.
Example:
- The "Official Announcements" board permission profile is used on the the "Club Announcements" board.
- In this permission profile, membergroup "Club Officers" is allowed to post new topics without approval
- While "Club Members" is not allowed to post topics without approval
- therefore, if a member belongs to both "Club Members" and "Club Officers", then the member is allowed to post new topics without approval.
Deny permission was added in SMF 2.0 to over-rule allowed permission. If a member belongs to a membergroup that has Deny chosen for a permission, then that member will not have that permission, even if that member belongs to a membergroup that has Allow chosen for that permission.
Example:
- The "default" board permission profile is use on the "Club Chit-Chat" board.
- In this permission profile, membergroup "Club Members" has permission "allow" to post new topics, without approval required
- But post-based membergroup "new member" has permission deny to post new topics, without approval required
- Therefore, every "new member" will always need approval on posts, even if they are also in "Club Members"
To enable deny permission, go to Permissions Settings and check the box for Enable the option to deny permissions. Deny permissions can be difficult to keep track of. Use them sparingly to avoid confusing problems when members belong to more than one membergroup. Deny permissions is not available for the Guest pseudo-membergroup, as guest never belongs to any other membergroup.
