Closed (fixed)
Project:
OG Forum
Version:
5.x-2.x-dev
Component:
Code
Priority:
Normal
Category:
Feature request
Assigned:
Reporter:
Created:
24 Feb 2007 at 21:41 UTC
Updated:
1 Jun 2009 at 20:55 UTC
When an unsubscribed member goes to the group home page it states: "No public posts in this group" but when the same user goes to the forums directly they can see the posts. There seems to be an access control problem.
Comments
Comment #1
rconstantine commentedSee post numbers 20 & 21 at http://drupal.org/node/121822. I can't remember if I listed this problem specifically, but I did solve it in my patch.
Comment #2
darren ohAt the moment, access to individual topics is restricted but access to the forums is not.
Comment #3
rconstantine commentedDarren> regarding my patch, if you want to pull out a smaller patch for this, check out og_forum_page. Changes make sure the user can't enter a forum node directly in their browser and see it. You may be able to get away without copying the stuff from forum_page and the three theme functions, but rather call the function forum_page itself.
Also, add both og_forum_set_og_group_context_from_tid and og_forum_gid_from_tid to support og_forum_page changes and other functions that will now call these.
Additionally, and most importantly, are the changes in the sql queries in og_forum_db_rewrite_sql. The comments in the code should explain why. The changes to the 'else' and 'else if' conditions also play a role in restricting access to correct forums. As I recall, one of your smaller patches stripped one of these conditionals so that a similar query wasn't changed when this hook was called from some other module. As that was a very specific case, and an unrelated module, it would probably be okay to apply my changes, have that person test it, and then make changes to this code, if needed, to satisfy that particular need if this breaks your previous change. Did that make sense?
Then, there were additions to og_forum_nodeapi. Load and View were added to satisfy some context issues. Prepare was modified to be more specific in setting the context.
Of course, og_forum_form_alter has changes so users can't add posts where they shouldn't.
I think that should be it. This should be the largest of the sub-patches to do as it touches so many functions.
Comment #4
femrich commentedI am a newbie (still) and not sure how to implement patches. I will investigate the documentation more to see if I can figure it out. However, I am wondering whether we can expect a new version of OG Forum that would include the patch anytime soon? Or has the patch been included already?
Comment #5
rconstantine commentedIt's mostly my fault that the patch hasn't been included yet as I implemented too many changes all at once. However, Darren said he'd work on splitting up the work into incremental patches and apply them. I've been too busy with other work to get to it myself, so encourage Darren, or if you're up to it, volunteer to help.
Comment #6
petegraham commentedI am working on a major project where I need to hide forums for non-members. I would like to help get this patch out as soon as possible, please contact me with details of how I can help development. I am a full-time PHP developer so don't mine getting my hands dirty with code ;-)
Comment #7
netranger commentedYes I would love to hide forums from non members. Any update on how things are going?
Comment #8
rconstantine commentedThe new 2.x version handles access to forums and containers. OG itself should be handling the nodes, including forum topics. It seems the current OG isn't doing a good job. I'm presently able to browse to groups to which I'm not subscribed and click on any nodes that show up on the group's front page. I'm opening an issue at the OG queue.
Comment #9
darren ohAre you sure you enabled Organic Groups access control?
Comment #10
rconstantine commentedOG access is on and I've reset it twice. The problem seems to be an entry in the table for node 0 having the view grant. I guess node 0 is a catch-all for nodes not specifically protected. But if I set the view grant to 0, something keeps changing it back to 1. Somebody else is having the same issue and so I've commented on the issue he opened over at OG. I haven't tried deleting the node 0 row yet because I don't know what that would do - any bad side-effects?
Comment #11
(not verified) commentedComment #12
andrenoronha commentedI'd like just the opposite.
How can I let all users see what's happening in the groups forum, without having to join it? they would need to join it just to post a reply to a topic.