Permission to create private discussions depends on global permission "Start discussions"

[Marco-Peter]

Bug Report

Current Behavior
Private discussions can only be initiated by users, who are also listed in the global permission "Start discussions", which allows globally to initiate any discussions.

Steps to Reproduce

1. Set global permission "Start discussions" to a limited user group (e.g. mods).
2. Set permission "Create private discussions with users" to all members
3. Try to initiate a private discussion with any other member
4. Posting is blocked with message "You do not have permission to do that."

Expected Behavior
Private discussions can also be initiated by users who do not have a global permission to initiate public discussions.

Environment

• Flarum version: 1.8.5
• Extension version: 1.3.6
• Website URL: https://forum.taikozuerich.ch
• Webserver: apache
• Hosting environment: shared
• PHP version: 8.3.8
• Browser: chrome 125.0.6422.142

[DavideIadeluca]

Hi @Marco-Peter, thanks for your bug report! I was able to verify your described behavior and see a couple of possible ways to resolve this issue:

1. Implement a Feature to override the "Create private discussions with users" permission to match those set in "Start discussions". Example: If "Start discussions" is limited to admins, then "Create private discussions with users" will automatically also be limited to admins. This behavior would then be basically the same as for the "Start discussions" and "Start discussions without approval" permissions.
2. Actually implement the ability to create private discussions, even if the global "Start discussions" is limited to, e.g., admins. This would then match your expected behavior.
3. Refactor the content structure in your Community so the Start discussions permission can be left to "Members".

Of those three options, I'm leaning towards 1 & 3. I have to say, it's rather an edge case that global discussions are limited to a user group, but private discussions are open to all members. Nonetheless, the UI for this case needs to be fixed. Achieving the expected behavior you described would certainly be my favorite, but I have the feeling that it would be somewhat complicated, as a private discussion is basically just a regular discussion with some extra fields.

@Marco-Peter Can you just refactor your content structure, or is option 2 the only way to resolve your issue?

[Marco-Peter]

Hi @DavideIadeluca, thanks for your reply.
Currently I have set the forum up using your 3rd suggestion, meaning that I have opened the global "Start discussions" permission to all members and then closed the the permission down on each section/tag where only mods should be allowed to write.

This works without any issues.
Since on our forum most sections are used for "official" notifications where we do not want to have people starting random threads, it's some additional work but still doable.

Having the possibility to lock down the permission and then selectively open them (by using the second suggestion) would of course be simpler and less error prone regarding forum management.

The first suggestion would definitively help to clarify things, since I actually only found out about this issue, when a normal member without extended privileges tried to send a private message.

[DavideIadeluca]

@Marco-Peter Glad to hear you've found at least a workaround in the meantime. I will have some thoughts about this and then aim for either option 2 (preferred from UX perspective) or option 1.