How/where does YAF decide what the permissions are per page? How does YAF know that I cannot load a page out of the pages/admin folder if I am not an admin?

In other words, if I create another page for my forum and/or website, where/how can I tell YAF to only allow users in a particular role/group to access that page(even if it's not in the page folder structure, perhaps it will be somewhere completely different).

Question not clear enough? Nobody have an answer?

Here's the bottom line:

What makes the Access Denied page come up if someone tries to load the user editor by a direct link if they don't the rights to view the page?

You could take a look at the source code how its done. To Check if the user has no access to site an redirect to the access denied page is very simple.


This would check if the user is an admin.

---

<sarcasm>Hmm.. hadn't thought of checking the source code.</sarcasm>

While see that your method is used here and there to hide a specific feature on the page, I see nothing in the admin pages that deals with security in the big picture.

What part of the code tells YAF that admin.aspx can only be loaded by someone in the admin group? If I'm a guest and I try to access the admin page, I get redirected to the access denied page, but not because of any code in that page that resembles the code you've suggested.

It's not JUST admin I want to check for.. I want to write more pages for the forum and give them rights similar to all the other built in forum pages.... assign roles/groups to the pages.... just like YAF has mysteriously done....