Message boards security

Message board

Based on the Access and Message board owner properties of the Message board web part, you can define who can add new messages to the board.

Changing the values

Remember that once the message board is created (after inserting first message or subscribing), you cannot make changes to these settings in the New board settings section of the web part properties. You can only modify values of the Access property on the Security tab (there referred to as Allow comments to) when editing the corresponding message board in the Message boards application.

The following table explains who can add messages to the board under particular configurations. The difference between User boards and Public boards is that Public boards are always related to a page, while User boards are always related to a page and a user.

Public boards are typically used when you want multiple users to post messages to it. User boards are typically used on user profiles.

Message board owner

Access

Anonymous user

Authenticated user

Authorized role

Owner

Owner in authorized role

Public board

All users

Public board

Authenticated users

Public board

Authorized roles

Public board

Owner

User

All users

User

Authenticated users

User

Authorized roles

User

Owner

When a board is in the User x Owner configuration, the following conditions need to be met in order for the current user to be able to post messages:

  • the page must be accessed with the userid or username parameter in the URL query string
  • the current user must be the same as the one whose userid or username is passed in the URL query string
  • the current user must not be hidden (configured by the Is hidden option when editing the user)

This can typically be used on user profiles, where messages to such a board can be posted only by the owner of the profile, while other users can only read these messages.

Group message board

The Group message board is always related to a group, which means that you can specify only the Access property.

Access

Anonymous user

Authenticated user

Authorized role

Group member

Group member in authorized role

Group admin

All users

Authenticated users

Authorized roles

Group members

Group admin

When the Group members option is set, the following conditions need to be met in order for the current user to be able to post messages:

  • the page must be accessed with the groupid parameter in the URL query string
  • the current user must be a member of the group whose groupid is in the URL query string
  • the current user must not be hidden (configured by the Is hidden option when editing the user)

This can typically be used on group profiles, where messages to such a board can be posted only by members of the group, while other users can only read these messages.

Permissions

You can set permissions for access to the Message boards administration interface in the Permissions application. You need to select the Modules -> Message boards permission matrix.

  • Modify – members of the roles can edit message board settings, delete the boards and manage message board posts.
  • Read – selected role members can read the records and configuration of particular message boards, but are not allowed to modify them.