Request: Code to restrict label permission to own threads

[think2succeed]

Hi all !

I posted this in the support board as well but I was told to post it here since PB default settings does not allow this:

Members and guests can see and sort labels, members can also apply labels BUT is there any way members are restricted to applying labels ONLY to the threads/posts created by them ? (otherwise any member can delete/modify all the labels on the board..and in my case I want to give my members the power to apply labels to their own threads/posts only).

So anyone knows how to do this?

Thanks.

[Chris]

think2succeed, using javascript code to restrict anything is far from foolproof because it runs in the browser and not on the server meaning it can be prevented in several ways from running. I don't think the mobile version allows you to set labels but if it does then that would be another way to bypass a code. As long as those two points are factored into your expectations of what a code can accomplish then this sounds like a fun code to write.

[think2succeed]

Thanks for your answer Chris,

Chris, I'm not worried about the mobile version since, as you assumed, labels aren't allowed there. I'm only trying to prevent members (using a desktop version) to delete/modify labels that were applied by other members. This way each member only has the power to delete/modify labels to the posts/threads they created so no conflicts would arise between members. So if you're willing to give it a try I'd appreciate it..as I'm sure other admins would too.

Thanks again.

[Chris]

OK think2succeed , here's a code for test driving, I need you to take it out on the highway and open her up a bit. Let me know if you notice anything such as hesitation during acceleration or perhaps a perceptible shimmy. There is only one coat of primer on the body right now so pay no attention to the appearance just yet.

I've done some very limited tests on thread view and post view pages but you'll need to do some more extensive testing

Global Header (or board header if only for certain boards):

<!-- Show label menu for thread owner only -->

<script>

//listen for menu creation events
//NOTE: using the form class to distinguish between post and PM should be safe since key set_on uses it too when building hidden field
$(document).on( 'selectmenucreate', 'form[class*="form_post_"] .options_menu, .posts .actions, .threads .actions', function (event, d) {
var ulmenu = $(this),
pbuser = pb.data('user'),
exempt_staff = false ;// set this to true to NOT affect staff members

//if this menu has a labels submenu then schedule an intervention
if (ulmenu.find('.labels') && (!pbuser.is_staff || !exempt_staff)) {
//install a callback to run just before the menu is displayed on screen
var backstage = ulmenu.data('selectMenu').options.beforeShow;
ulmenu.data('menu').options.beforeShow = function () {
var retval = backstage.apply(this, arguments);
var listMan = proboards.listManagers[pb.data('lm_id')];
var pbthreads = pb.data("proboards.thread");
try{
//actions menu on thread list page allows for batch processing of threads
//so check for threads not started by this user within that batch
//
if ( (listMan && listMan.item_type == "thread") || (pbthreads && !pb.data("proboards.post") && !pb.data('wysiwyg_css')) ) {
selected = listMan ? listMan.selected_ids : [];
if(selected.length){
/*
Some thread views such as search by IP do not return any "proboards.thread" data for the page or returns an empty hash
so we need to crawl the DOM to gather the info instead which can be hit or miss
due to theme changes. Build a partial "proboards.thread" only with the info we need (i.e. created_by)
Don't need it for search by IP per se since no label menu there but there may be others
*/
if( !pbthreads || $.isEmptyObject(pbthreads)){
pbthreads = {};
listMan.content.find('>[id]').each(function(i,e){
var t_id = $('.main .thread-link', this).idFromClass('thread'); //theme needs the "main" and "thread-link" classes
var u_id = $('.created-by .user-link',this).idFromClass('user'); //theme needs the "created-by" and "user-link" classes
if(isNaN(t_id) || isNaN(u_id)){
//unable to crawl so just disable the label menu then bail
console.log('Unable to identify thread owners due to alien structure in theme with the ID of ' + pbuser['theme_id'] );
ulmenu.find('.labels.ui-menu-has-sub-menu').remove();
return false;
}
pbthreads[t_id]={"created_by":u_id}
})
}
for (var tid in pbthreads) {
//if just one thread is selected which is not authored by this user then hide labels menu
if (pbthreads[tid].created_by != pbuser.id && selected.indexOf(tid) !== -1) {
ulmenu.menu('hideOption', '.labels');
//ulmenu.find('.labels.ui-menu-has-sub-menu').remove();
break;
}
}
}
} else {
//Actions menu in post view and on WYSIWYG cog menu apply only to a single thread
if (pb.data('page').thread.created_by != pbuser.id) {
//ulmenu.menu('hideOption', '.labels');
ulmenu.find('.labels.ui-menu-has-sub-menu').remove();
}
}
}catch(warren_g){
pb.window.error(warren_g.message);
}finally{
return retval;
}
}
}
})
</script>


[think2succeed]

Wow you're good and fast ! That worked beautifully ! Excellent piece of code and well commented as well. I tested it as a guest, admin (it lets me add/delete/modify any label i wish), and as a logged in member. So far nothing weird or any bugs...if i heard of any...I'll let you know . Thanks a lot !

PS: now that I experienced how good you are as a coder can I ask you for a plugin as well ? ( something that actually would be of great help to all proboards admin/users, not to mention this board). It's something similar to this plugin www.proboards.com/library/plugins/item/416 but taken to another level...

[Chris]

That plugin by Wormopolis is a port from the older Proboards V4 and from what I can tell now comes builtin with the support of the title attribute in V5. You can do something like [a href="http://google.com" title="Hello Google"]search[/a] which would display "Hello Google" upon hover. I'm not sure what you mean by "taken to another level" but if you mean appearance then Brian has an excellent Tooltips plugin that would make it look purr-dee.
If you intend to write a novel or include not just text (images, iframes, etc.: is that supported in your plugin Wormo?) in the popup then the plugin would probably be a better fit. I know the tooltip widget included with Proboards supports HTML but I'm not sure if Brian has sanitized it to avoid exploits originating from user-generated content within his own plugin.

[think2succeed]

Chris,

Let me explain what I mean by taken to another level. The current plugin (tangents 1.0.1) is not easy to use by a regular forum member as that requires him to enter some code, to know of the existence of tag words etc. for each post he composes.

My idea was as follows:

1. only admins and/or stuff can edit this plugin's settings but everyone can see its effects. (users should have the option though to turn on/of the tagging when reading the board).

2. before the plugin is active the admin adds a list of terms (with associated definitions) that will automatically become tagged in EVERY post on the entire forum. Each term from the list has an associated definition that will appear on hover in all posts. When the admin edits the list a definition can be associated with 1 or more terms (to include synonyms too).

Now imagine the implications of all this...there are many forums on proboards with highly specific terms that users could easily understand via an instant help when they hover over tagged words. Just in this forum for example imagine how easy it would become for new admins to know what a style sheet is, forum wrapper, super key etc....for posters as well...imagine you don't have to explain every time you post where the global header is, or what a label means etc.

Each admin edits the list once (or more if you wish to add more terms later) and then voila ! Instant help throughout that forum for a number of highly specific terms that are relevant to that forum. I think that would be very useful as a feature or a plugin to be available on proboards.

[Chris]

David made a plugin doing what I think you're describing (example: see "style sheet" in this post) although I'm unsure if he has released it to the public just yet. My apprehension about such a plugin however is there is a finite amount of storage space allocated to each plugin so whenever I see this request it sounds to me like the requester is expecting the ability to add anything they want to infinity and beyond, which won't happen and lead to eventual disappointment. Even if you warn someone about the limitations they usually nod their head then come back later repeating the same thing you had just warned them about and looking for a "fix".

My view is that it would be more feasible to use the censored words feature to convert those words/phrases into elements containing the aforementioned title attributes since the space given to censored words far exceed the space given to any plugin. The one downside I've seen with that censored word method however, is that it doesn't distinguish between content within a post and content supplied elsewhere such as thread subject, so the use of those words would have to be avoided elsewhere or the use of a recognizable pattern not normally seen in the wild would probably be necessary (for example prepending a word with an underscore :not tested:). This would of course require a conscious effort on the part of the poster to add that pattern thus taking you full circle back to "requires him to enter some code, to know of the existence of tag words etc. for each post he composes".

The limitation is one of a structural space constraint, you would need to rent space on a server to store and serve up your full size dictionary. In the olden days of V4 we were limited to storage the size of a postage stamp and now we are thankfully given storage the size of a stack of post-it notes but we do not have the means to store entire reference libraries just yet. Maybe someone with a deep pockets and a philanthropic spirit will come along and get this done but a plugin using standard storage would not be capable of storing a dictionary of jargon beyond a rudimentary list.

The alternative then is to use an existing library such as wikipedia which I'm sure I've seen mentioned before as offering an API (which I will look into further). That however is not any guarantee since other services that offer APIs, such as dropbox or steam, requires the use of a "secret key" used in conjunction with an appid to fully authenticate the request and plugins offer no mechanism to keep certain data from prying eyes. You also wouldn't be be able to create your own definitions (or less work depending on how you look at it) and word selection might be problematic unless the API offers some filtering criteria. It would operate similar to how the builtin Viglink Insert, under marketing in your admin panel, operates but with no way for you to earn money from it. This of course is contingent on the API being workable from a plugin format.

[Wormopolis]

Dec 18, 2015 2:58:23 GMT -8 Chris said:

That plugin by Wormopolis is a port from the older Proboards V4 and from what I can tell now comes builtin with the support of the title attribute in V5. You can do something like [a href="http://google.com" title="Hello Google"]search[/a] which would display "Hello Google" upon hover. I'm not sure what you mean by "taken to another level" but if you mean appearance then Brian has an excellent Tooltips plugin that would make it look purr-dee.
If you intend to write a novel or include not just text (images, iframes, etc.: is that supported in your plugin Wormo?) in the popup then the plugin would probably be a better fit. I know the tooltip widget included with Proboards supports HTML but I'm not sure if Brian has sanitized it to avoid exploits originating from user-generated content within his own plugin.

It won't support iframes.  It will relocate the rendered ubbc from the post into the floating divs, so content has to conform to bbc rules.  Otherwise it would become a security risk.  

[Wormopolis]

Dec 18, 2015 3:26:29 GMT -8 think2succeed said:

Chris,

Let me explain what I mean by taken to another level. The current plugin (tangents 1.0.1) is not easy to use by a regular forum member as that requires him to enter some code, to know of the existence of tag words etc. for each post he composes.

My idea was as follows:

1. only admins and/or stuff can edit this plugin's settings but everyone can see its effects. (users should have the option though to turn on/of the tagging when reading the board).

2. before the plugin is active the admin adds a list of terms (with associated definitions) that will automatically become tagged in EVERY post on the entire forum. Each term from the list has an associated definition that will appear on hover in all posts. When the admin edits the list a definition can be associated with 1 or more terms (to include synonyms too).

Now imagine the implications of all this...there are many forums on proboards with highly specific terms that users could easily understand via an instant help when they hover over tagged words. Just in this forum for example imagine how easy it would become for new admins to know what a style sheet is, forum wrapper, super key etc....for posters as well...imagine you don't have to explain every time you post where the global header is, or what a label means etc.

Each admin edits the list once (or more if you wish to add more terms later) and then voila ! Instant help throughout that forum for a number of highly specific terms that are relevant to that forum. I think that would be very useful as a feature or a plugin to be available on proboards.

I would add a button if it were an easier process to select text in all the dang browser choices.  

[think2succeed]

Dec 18, 2015 5:28:23 GMT -8 Chris said:

David made a plugin doing what I think you're describing (example: see "style sheet" in this post) although I'm unsure if he has released it to the public just yet. My apprehension about such a plugin however is there is a finite amount of storage space allocated to each plugin so whenever I see this request it sounds to me like the requester is expecting the ability to add anything they want to infinity and beyond, which won't happen and lead to eventual disappointment. Even if you warn someone about the limitations they usually nod their head then come back later repeating the same thing you had just warned them about and looking for a "fix".

My view is that it would be more feasible to use the censored words feature to convert those words/phrases into elements containing the aforementioned title attributes since the space given to censored words far exceed the space given to any plugin. The one downside I've seen with that censored word method however, is that it doesn't distinguish between content within a post and content supplied elsewhere such as thread subject, so the use of those words would have to be avoided elsewhere or the use of a recognizable pattern not normally seen in the wild would probably be necessary (for example prepending a word with an underscore :not tested:). This would of course require a conscious effort on the part of the poster to add that pattern thus taking you full circle back to "requires him to enter some code, to know of the existence of tag words etc. for each post he composes".

The limitation is one of a structural space constraint, you would need to rent space on a server to store and serve up your full size dictionary. In the olden days of V4 we were limited to storage the size of a postage stamp and now we are thankfully given storage the size of a stack of post-it notes but we do not have the means to store entire reference libraries just yet. Maybe someone with a deep pockets and a philanthropic spirit will come along and get this done but a plugin using standard storage would not be capable of storing a dictionary of jargon beyond a rudimentary list.

The alternative then is to use an existing library such as wikipedia which I'm sure I've seen mentioned before as offering an API (which I will look into further). That however is not any guarantee since other services that offer APIs, such as dropbox or steam, requires the use of a "secret key" used in conjunction with an appid to fully authenticate the request and plugins offer no mechanism to keep certain data from prying eyes. You also wouldn't be be able to create your own definitions (or less work depending on how you look at it) and word selection might be problematic unless the API offers some filtering criteria. It would operate similar to how the builtin Viglink Insert, under marketing in your admin panel, operates but with no way for you to earn money from it. This of course is contingent on the API being workable from a plugin format.

Chris , 

I don't want the user to make any conscious effort. He would just type his message and after posting it all words found in the dictionary would become underlined with a dotted line let's say...that would be the ideal scenario imo. I see what you're saying with the storage constraint but proboards could allow this plugin or if they implement it as a feature and only allow an initial 100 words per dictionary each with a maximum of  let's say 150 words for a definition...I don't think this would take up too much storage then proboards could even monetize this (as they do with the plugins/keys) by selling the ability to add another 100 words for let's say $3...win-win. But in my opinion most admins would be happy with 100 words (even with just 50 for many). Good idea with the censored words work around...didn't think of that.

[think2succeed]

Wormopolis,

"I would add a button if it were an easier process to select text in all the dang browser choices."

Your plugin is a great idea and I wasn't criticizing it...I understand there are limitations in what you can do as plugin developers.