When a user with 'administer nodes' but not 'administer menus' edits (and saves) a node that is in an OG Menu, the menu association is lost for the node.

This is happening (at least partially) because this call to og_is_group_member() in og_menu_access() returns true if the user has 'administer nodes' permissions:

    if ($node && og_is_group_member($node)) {
      return TRUE;
    }

I think we probably want to pass FALSE into og_is_group_member() as the second parameter here to avoid this problem.

CommentFileSizeAuthor
#1 og-menu-administer-nodes-1031716-2.patch1002 bytesmarcp

Comments

marcp’s picture

marcp commented
Status: Active » Needs review
StatusFileSize
new og-menu-administer-nodes-1031716-2.patch1002 bytes

The attached patch sends in FALSE as the 2nd parameter to og_is_group_member() in the two places its called in og_menu_access().

This also fixes a bug where users with 'administer nodes' but not 'administer menu' can visit node/%node/og_menu/%menu (and everything under there) even though they are unable to visit node/%node/og_menu.

marcp’s picture

marcp commented

Note that this patch is against HEAD, though I'm wondering about this: #1031886: HEAD or DRUPAL-6--2?.

jide’s picture

jide commented

@marcp : Thanks for the patch, I'll try this soon, and have a look at the mess with HEAD.

jvieille’s picture

jvieille commented

This patch does not seem to work.
When I apply it (manually) to the last dev, the menu options are showing up on nodes, but the menu fields are grayed. When editing a node attached to a menu link, it is ticked for deletion.
So, same problem, bu even more obvious

pfrenssen’s picture

pfrenssen
Location Sofia
commented
Issue summary: View changes
Status: Needs review » Closed (outdated)

Closing, since the Drupal 6 version of OG Menu is no longer supported. If this issue is still relevant for the currently supported versions (D7 and D8) then feel free to update the version and reopen the issue.