1. I have created one role “R1” and given View and Add permission on particular folder. Now users belong to the role “R1 are able to edit the documents of that folder evenif I have not given the “EDIT” permission to "R1".

2. What I know is that If user has Add permission then he can add new collection/file and if user has edit permission then he can modify the document and its attributes. Please let me know if I am wrong. 

3. I have updated the View/Add/Edit permissions for the root folder and check the “Unify permission on children” checkbox and save it. However permissions are not modified for the child folders. Am I missing something?

Saurabh,

When a document is added to a folder, the add permissions become the edit permissions. This follows along the lines Windows behaves. It prevents people uploading something and then not being able to edit it any longer. A folder type child, receives both add and edit permissions from the add permission of the parent folder.

Peter

Thanks for the qucik reply.

When I modify the add/edit permission of root folder and set the "Unify permission on children" checkbox, even if add/edit permission of children folder do not change and do not same with parent folder.

I will look into that. The behavior is currently being examined.
Peter

Hi, interesting thread.

The logic to associate a parent folder's Add rights to a new document and to associate both Add and Edit rights to a new subfolder (as Peter described above) is puzzling at first sight but the best solution now that I think about it. I only wished it had been described somewhere in a help document or somewhere within the module. Well...

Unfortunately I also have the problems with changing permissions and unifying them for children: sometimes it works, sometimes it doesn't - espeacially withdrawing/deleting permissions often isn't applied to children.

First I thought that withdrawing a permission for a certain role only fails if one of the documents or subfolders concerned had been created by a member of this role - in other words: with "unify on children" I cannot withdraw an author's rights? But now I did additional tests and I am not sure anymore...

Mathias

Oups, after more testing I can reproduce one odd thing for sure now: When I create a subfolder the automatic setting of permissions is:

"Edit" of subfolder = "Add" + "Edit" of parent folder !!!!

while it should be - to my opinion and according to Peters reply above: "Edit" of subfolder = "Add" of parent folder!

Peter, what do you think?

 

Mathias,

I'll write it out some day soon. The observed behavior is correct. The reasoning behind it is this: ADD permissions on a folder are usually something more 'restrictive' than EDIT. You probably would not want anyone that can add to a folder be able to change that folder's name or permissions. So the EDIT is 'more powerful' a feature. It does not hold the other way round, though. Someone with EDIT permissions on the folder would normally be allowed to add stuff (granted that is not the case in practice). If not, he/she can always edit the folder and grant themselves this permission. So there was no use case where someone with EDIT permissions on a folder would NOT be allowed to control what was underneath. Hence the union of the two downward. I'll have a long hard look at this again these days as I'm trying to improve the performance of the 'unify' command. What do you think?

Peter

I have just verified the latest code base and currently the logic is as follows:

folder to folder:
All Permissions copied
+ ADD -> EDIT permissions

folder to file/hyperlink:
VIEW/APPROVE copied
EDIT removed!
ADD -> EDIT

The challenge lies in the fact that not all types in the document exchange have the same types of permissions that would apply. ADD permission, for instance, do not apply to a file or a hyperlink. Now, if I unify I need a more simple routine for inheritance as the current recursive code can lead to timeouts on 'large' installations. So I'm looking at simplifying this.

Peter
Peter

Peter,

Above you have explained the logic of add/edit permission of sub folder and documents. But what is the usage of “Unify permission on children” checkbox in add/edit mode of folder?

This will traverse all items below that folder and set the permissions to the permissions you just set on that folder following the rules I just specified above. Warning: this can take a while if it is a huge repository.
Peter