What is the difference between these 3
Leader (TL4) is the highest non-staff level one can have.
Moderator can do anything related to moderation of forum
Admin can tinker with more advanced forum settings.
4 Likes
In fact, admins can do everything.
2 Likes
If the admin #1 (creator of the forum) put āJohnDoeā as adminā¦ can JohnDoe remove the adminās role to user #1 ?
1 Like
Good point. The answer is no, unless John Doe also has ssh access to the server because the creator admin has her email in the app.yml which makes it unremovable via the discourse UI.
And here is another privilege of the ācreator adminā:
5 Likes
It is actually a good question - I thought I was clear on this but am realising I canāt define it and therefore not 100% sure
I am clear about Admin vs non-admin
ā¦ but are there any practical differences between Moderator and TL4?
If you want to grant extra rights to members of your community without giving them access to the settings and the member data of the site, should you make them a Moderator, or upgrade them to TL4 instead?
2 Likes
TL4 is only limited to moderation of posts made by them and others.
However, moderators can do much more. Including creation of categories, viewing stats, moving posts etc.
There is very less to distinct between both but I think that /admin route is only accessible to moderators and above. Also, moderation related notifications (flags & reports) are only sent to moderators not to TL4.
3 Likes
I think if you give this a read it should answer a lot of questions for you
2 Likes
The very high level answer is that TL4s can moderate content. Mods can moderate content and users.
TL4 has no visibility of flags etc.
14 Likes
Thanks for this. I knew a lot of this in principle, but it isnāt until you really put this into practice that you notice the issues and shortcomings.
Sadly, this is not delivering what I needed and Iām not sure if this is because Iām missing something, or whether I need to post something to #feature
It seems that āModeratorsā are a form of lesser-Admin. I understand that this is so that they can help to manage the content at a very high level (including the creation of categories and so on) and it is therefore assumed that they also need some user access.
However, in the post-GDPR world, in terms of data security and privacy, this poses a MAJOR issue. It means that any moderator can access the admin areas of the community and visit the user page and download the main database with personal information from the SSO process including names and email addresses. This is not acceptable.
We would therefore default to making our ācitizen moderatorsā TL4 users who can still modify content, but not access users or make structural changes. That is fine. However, it also means that they will never see flags either. Whilst certain serious issues, such as inappropriate behaviour, might require an adminās view of the userās history, that isnāt the case for notifications about broken links, incorrect categorisation, spam, etc.
Am I alone in feeling that we need something in-between, that gives broad access to content and flags, but withholding access to all user data?
Is there another way to achieve this?
7 Likes
Wait, what? As a moderator, I am not able to download the main database. I can view a userās email address, which is then logged that I did it, but it is very much me visiting user after user after user. Can you elaborate on what you mean by ādownload the main databaseā?
3 Likes
if you go to the āuserā tab in Admin pages as a moderator, you still have access to the āexportā feature. While I didnāt actually test it, Iām assuming (possibly incorrectly) that this is the same export report that I get as admin, and this includes email addresses and data in custom fields from SSO
EDIT: yes, I just re-tested it and downloaded the āuser listā with all the information I could want on the members while impersonating a user with ONLY moderator access, not admin level
SECOND EDIT: Looking at the logs, I also donāt see an entry for the user exporting the user list. I can see the log for my impersonation of the user, and the deletion of the PM with the export link, but no reference to the fact that the user list was exported
5 Likes
Oh, I see, that was not what I inferred from your original post. Now it makes sense. Iād actually be perfectly okay if that Export button wasnāt visible to Moderators, I personally never use it (as a moderator on a Discourse site). Iām not sure what moderators would be using that data forā¦
1 Like
exactly! This would have to be hidden, and arguably we would need the option to hide custom fields in the admin version of user profiles too (as SSO carries through email).
In answer to your question, probably nothing good - and we might get into trouble with data authorities (I suspect) for not locking down access to private / personal information
1 Like
I had missed that conversation - thanks
Still canāt see why the export button should be there - hopefully that will be removed too. Is this something I should cross-post there, do you think?
I think the removal of it should be a different topic, maybe in #feature, with a list of bullet points as to why Moderators do not need it.
5 Likes
How many Moderators can there be on a basic plan forum?
For sites on our hosting, our Standard plan allows for up to 5 staff members. A staff member is any user who is either an admin, a moderator, or both an admin and a moderator.
2 Likes