---
title: Message boards security
related:
  - https://docs.kentico.com/k12sp/securing-websites.md
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

## Message board

Based on the **Access** and **Message board owner** properties of the **Message board** web part, you can define who can add new messages to the board.

> **Note:** **Changing the values**
>
> Remember that once the message board is created (after inserting first message or subscribing), you cannot make changes to these settings in the **New board settings** section of the web part properties. You can only modify values of the **Access** property on the **Security** tab (there referred to as **Allow comments to**) when editing the corresponding message board in the **Message boards** application.

The following table explains **who can add messages to the board** under particular configurations. The difference between **User boards** and **Public boards** is that **Public boards** are always related to a page, while **User boards** are always related to a page and a user.

**Public boards** are typically used when you want multiple users to post messages to it. **User boards** are typically used on user profiles.

| Message board owner | Access                  | Anonymous user | Authenticated user | Authorized role | Owner | Owner in authorized role |
| ------------------- | ----------------------- | -------------- | ------------------ | --------------- | ----- | ------------------------ |
| **Public board**    | **All users**           |                |                    |                 |       |                          |
| **Public board**    | **Authenticated users** |                |                    |                 |       |                          |
| **Public board**    | **Authorized roles**    |                |                    |                 |       |                          |
| **Public board**    | **Owner**               |                |                    |                 |       |                          |
| **User**            | **All users**           |                |                    |                 |       |                          |
| **User**            | **Authenticated users** |                |                    |                 |       |                          |
| **User**            | **Authorized roles**    |                |                    |                 |       |                          |
| **User**            | **Owner**               |                |                    |                 |       |                          |

When a board is in the **User x Owner** configuration, the following conditions need to be met in order for the current user to be able to post messages:

- the page must be accessed with the _userid_ or _username_ parameter in the URL query string
- the current user must be the same as the one whose _userid_ or _username_ is passed in the URL query string
- the current user must not be hidden (configured by the _Is hidden_ option when editing the user)

This can typically be used on user profiles, where messages to such a board can be posted only by the owner of the profile, while other users can only read these messages.

## Group message board

The Group message board is always related to a group, which means that you can specify only the **Access** property.

| Access              | Anonymous user | Authenticated user | Authorized role | Group member | Group member in authorized role | Group admin |
| ------------------- | -------------- | ------------------ | --------------- | ------------ | ------------------------------- | ----------- |
| All users           |                |                    |                 |              |                                 |             |
| Authenticated users |                |                    |                 |              |                                 |             |
| Authorized roles    |                |                    |                 |              |                                 |             |
| Group members       |                |                    |                 |              |                                 |             |
| Group admin         |                |                    |                 |              |                                 |             |

When the **Group members** option is set, the following conditions need to be met in order for the current user to be able to post messages:

- the page must be accessed with the _groupid_ parameter in the URL query string
- the current user must be a member of the group whose _groupid_ is in the URL query string
- the current user must not be hidden (configured by the _Is hidden_ option when editing the user)

This can typically be used on group profiles, where messages to such a board can be posted only by members of the group, while other users can only read these messages.

## Permissions

You can set permissions for access to the **Message boards** administration interface in the **Permissions** application. You need to select the **Modules -> Message boards** permission matrix.

- **Modify** – members of the roles can edit message board settings, delete the boards and manage message board posts.
- **Read** – selected role members can read the records and configuration of particular message boards, but are not allowed to modify them.