Multiple User Support

Vanilla comes with two methods to authenticate your administrative users straight out the box. The default method (and by far the most practical) uses MySQL to store user and privilege data. The second method employs Apache's built-in HTTP authentication and can only store simple usernames and passwords (within a .htpasswd file). New users can be added with a couple of clicks and existing users can be deleted or edited just as easily.

And of course, passwords are never stored as plain text.

Roles and Privileges

If you're using the MySQL authentication method (and only if), Vanilla also supports the following user roles and privileges:

Super Administrator

Can create, edit and delete any content, make changes to system-wide settings and edit all other users and permissions. Can also embed PHP within their pages (including that generated by FooBank).

Administrator

Can create, edit and delete pages, make changes to certain system settings and edit other users (if they have the password). Administrators can also choose the minimum role required to edit pages on a per-page basis.

Editor

Can only create, edit and delete page content (including the File and Upload Manager). No access to any other settings.

Contributor

Can only create new inactive pages. Contributors cannot set their pages live - this must be done by an Editor or Administrator. They can only edit existing pages if they are the creator, the page permission allows it and it is not yet live. To prevent mishaps and avoid the accidental deletion of core system files, Contributors do not have any access whatsoever to the File or Upload Manager features.

Access Inheritance

When a new page is created, it is immediately given the access level of the user that created it. For example, if I am logged in as an Editor, the pages I create can only be edited by other users with a role of Editor or above.

Locking Yourself Out

Be aware that it is possible to for users to set a page's access level higher than their own role. For example, I could log in as an Editor and set a page's access level to Super Admin. I would then be 'locked out' of the page on subsequent visits.

PHP Content

If pages contain PHP scripts, only super administrators can view or edit them.