I have seen a few reports about the contents restricted to a group exposed to users not in the group. With my fresh Drupal 5 and OG 5.x2.2 install, this problem is especially serious.

My test case is that I have Group A and Group B, also User A and User B. I add User A to Group A and User B to Group B. I set "Visibility of posts" to "Visible only within the targeted groups".

First try:
I activated OG without the OG Forum module. I found that there is no way I could create a forum within a group or to attach it to a group if I create it outside the groups (in other words, independently from groups).
In other words, I can't create forums dedicated to a group.
Then I installed/activated the OG Forum module. It can not only create a forum that belongs to a group every time I create the group as new, but also allows me to "Update old groups" by creating a new forum and making it associated with each old group (a one created before I activated OG Forum).
However, after all the groups and forums and the associations are in place, my User A (a member of Group A but not Group B) can easily post to the forum that belongs to Group B. And User B can do the same to Group A.

Second try:
I deleted my Drupal database and started another fresh install. This time I activated the OG and OG Forum modules at the same time from the very beginning. I created the same sets of Groups/Users. Now with each group created, there is a forum created along with it.
However, before I added any user to any group, my users can already post to any of the groups created by OG Forum.
The situation is the same as my first try after I added the users to the groups.

Is there any way I can make it work so that once a forum is created for a group, its visibility and access are protected?

Comments

walterhoct’s picture

walterhoct commented
Status: Active » Closed (duplicate)

I guess I can post this problem to the OG Forum issue tracking.

The question/issue still remains with the OG module: should the OG module cover the access control of all the content types, including forum? I think the answer should be YES. Because otherwise what happens is exactly what's going on right now. OG and OG Forum have been developed as 2 separate tracks and the consistent access control is hard to achieve.

Hope this is helpful to the developers.