Future Fix Alert opt outs are shown even without permission to view or create

[Kirby]

Showcase Version

SC 3.3.6

XenForo Version

2.3.6

PHP Version

8.3.20

Database & Version

MariaDB 10.11.11

Are there any errors being throw?

No

We are currently not planning to use pages, updates or series and thus set the related permissions to view and create those for Registered to Never.

This works, eg. users can't create or view those.

But they are still seeing related alert opt-outs in their preferences which is confusing, we'd therefore like to disable / hide those as well if the user has no permission:

It would be nice if this was possible out of the box.

 

[Bob]

It would be nice if this was possible out of the box.

It is via getOptOutActions() in each appropriate Alert Handler. One just needs to wrap the appropriate actions with a "can view" permissions check (or can create depending on the action types).

Example... here is the getOptOutActions() in the Profile Posts Alert Handler. If the viewing user does not have permission to view Profile Post, it won't return any actions.

    public function getOptOutActions()
    {
        $visitor = \XF::visitor();

        if ($visitor->canViewProfilePosts())
        {
            return [
                'insert',
                'mention',
                'reaction',
            ];
        }
        else
        {
            return [];
        }
    }

So yes, I can do this (which is more of a suggestion as a bug as XF only does this for Profile Posts and Profile Post Comments, no other Core XF alert handlers, nor does XFRM or XFMG).

Make sense, so I've targeted the next maintenance release to implement this in all alert handlers in all of my addons (might take me a minute tho and it might be best to include it with XF 2.4 versions of my addons as a target).

Hope all that made sense, I am just waking up and have had 3 sips of coffee! ha!

 

[Kirby]

It is via getOptOutActions() in each appropriate Alert Handler. One just needs to wrap the appropriate actions with a "can view" permissions check (or can create depending on the action types).

Yeah, and that is missing - which is why I am reporting this as a bug.

However, I think it is not as easy as just checking a single permission (like it is done for profile posts):
A user could have xa_showcase / viewUpdates no via their usergroups but have that yes in one or more categories.

In this case the controls should be shown.