What is meant by, “A user shouldn't decide whether it is an Admin or not. The Privileges or Security system should.”
The example used in the question pass bare minimum data to a function touches on the best way to determine whether the user is an administrator or not. One common answer was: user.isAdmin() This ...
Elgg is designing a permissions API loosely around the Activity Streams model. The user API could look (roughly) like: function elgg_can($capability, $subject = null, $object = null, $target = null) ...
Which approach makes most sense to use, the destructive one or the non-destructive one? Does anyone have real-world experience with one, both or even a different approach? Model A permission scheme ...