# Restricting poll creation to Trust Levels

**URL:** https://meta.discourse.org/t/restricting-poll-creation-to-trust-levels/46379
**Category:** Feature
**Tags:** completed
**Created:** [24 ביוני,‏ 2016,‏ 1:51am UTC](https://meta.discourse.org/t/restricting-poll-creation-to-trust-levels/46379 "2016-06-24T01:51:51Z")
**Posts on this page:** 7
**Page:** 2

<div class="post-metadata">

### Author: ![eviltrout](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/eviltrout/32/5275_2.png) [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [15 ביולי,‏ 2016,‏ 6:55pm UTC](https://meta.discourse.org/t/restricting-poll-creation-to-trust-levels/46379/21 "2016-07-15T18:55:32Z")

</div>

The difference is polls are a plugin and the interface for plugins has a “disabled” property that is being used here.

I have been very clear in the API so far that disabled means “don’t initialize this plugin.” It’s a miracle it works with the current hack, and I’m pretty sure in the future it will suddenly break if we depend on this behaviour.

If we want admins to be able to create polls we have to add a new setting for it.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [15 ביולי,‏ 2016,‏ 8:06pm UTC](https://meta.discourse.org/t/restricting-poll-creation-to-trust-levels/46379/22 "2016-07-15T20:06:34Z")

</div>

Aha, it is a plugin limitation. OK I can agree with adding the setting in that context @tgxworld . The other option is to make polls part of core but that would likely be more work.

---

<div class="post-metadata">

### Author: ![tgxworld](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tgxworld/32/106117_2.png) [@tgxworld](https://meta.discourse.org/u/tgxworld)
#### Post date: [16 ביולי,‏ 2016,‏ 3:18am UTC](https://meta.discourse.org/t/restricting-poll-creation-to-trust-levels/46379/23 "2016-07-16T03:18:18Z")

</div>

> [@eviltrout](#):
>
> I have been very clear in the API so far that disabled means “don’t initialize this plugin.” It’s a miracle it works with the current hack, and I’m pretty sure in the future it will suddenly break if we depend on this behaviour.

It isn’t clear to me from `Plugin::Instance`’s

> <https://github.com/discourse/discourse/blob/b8261a662bd185b1e51883a21c50054ca2e6c21e/lib/plugin/instance.rb#L55>

If the plugin author doesn’t call `enabled_site_setting`, the plugin is going to be enabled by default and disabling the plugin via the site setting will be handled by the author. There isn’t any hack I had to do in order to implement the feature. Right now, the only way to truly disable a plugin is actually to remove it if the plugin author doesn’t handle it. We will probably want to have some form of enforcement as to how enabling/disabling plugins is handled but I’ll leave that for another topic.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [16 ביולי,‏ 2016,‏ 5:17am UTC](https://meta.discourse.org/t/restricting-poll-creation-to-trust-levels/46379/24 "2016-07-16T05:17:30Z")

</div>

We need a method of globally disabling all plugins aka “[safe mode](https://meta.discourse.org/t/53504?silent=true)” for 1.7.. could this work be folded into that?

---

<div class="post-metadata">

### Author: ![tgxworld](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tgxworld/32/106117_2.png) [@tgxworld](https://meta.discourse.org/u/tgxworld)
#### Post date: [18 ביולי,‏ 2016,‏ 2:58am UTC](https://meta.discourse.org/t/restricting-poll-creation-to-trust-levels/46379/25 "2016-07-18T02:58:35Z")

</div>

Ok I’ll take that once we start working on 1.7. 🙂

---

<div class="post-metadata">

### Author: ![eviltrout](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/eviltrout/32/5275_2.png) [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [18 ביולי,‏ 2016,‏ 4:10pm UTC](https://meta.discourse.org/t/restricting-poll-creation-to-trust-levels/46379/26 "2016-07-18T16:10:08Z")

</div>

> [@tgxworld](#):
>
> If the plugin author doesn’t call enabled\_site\_setting, the plugin is going to be enabled by default and disabling the plugin via the site setting will be handled by the author.

Oh I see - in this case you weren’t using `enabled_site_setting` ? Because that’s the feature that allows a plugin to be intelligently enabled/disabled and was in fact what was I referring to.

If we’ve implemented the same behaviour without using those hooks it _should_ be safe, although it’s a little [surprising](https://en.wikipedia.org/wiki/Principle_of_least_astonishment) to me since it dodges our built in code that does a similar thing with a similar name.

I’m okay with it for now - but in the future if we migrate it to use `enabled_site_setting` it’s something we have to be aware of.

---

<div class="post-metadata">

### Author: ![JammyDodger](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jammydodger/32/254611_2.png) [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [1 במאי,‏ 2023,‏ 10:13am UTC](https://meta.discourse.org/t/restricting-poll-creation-to-trust-levels/46379/28 "2023-05-01T10:13:29Z")

</div>



[Previous page](https://meta.discourse.org/t/restricting-poll-creation-to-trust-levels/46379.md?page=1)
