Perhaps it's a redirect issue, but if I disable the view published content permission for anonymous users, new user accounts fail to be created.

Comments

areynolds’s picture

Could this be because of the "access content" permission requirement on the Menu API definition for the FB action links?

  $items['fboauth/%fboauth_action'] = array(
    'title' => 'Facebook connect',
    'page callback' => 'fboauth_action_page',
    'page arguments' => array(1),
    'access arguments' => array('access content'),
    'file' => 'includes/fboauth.fboauth.inc',
    'type' => MENU_CALLBACK,
  );

I can identify three major use cases regarding registration permissions and fboauth:

  1. Anyone can register, all users (including anonymous) can see content
  2. Anyone can register, only registered users can see content
  3. Only select people can register/see content

If we eliminate the access content requirement for fboauth actions, we satisfy the first two cases. As long as fboauth respects Drupal core's handling of login procedures (i.e. the settings regarding who may create an account in Account Settings), it should satisfy the last case as well. However, I don't believe that it does.

Would eliminating the access content requirement and bringing fboauth inline with Drupal's default handling of login cases fix the problem, or just create more?

quicksketch’s picture

There's definitely no problem with eliminating the access check, let's take that approach.

areynolds’s picture

Status: Active » Needs review
StatusFileSize
new412 bytes

Ok, patch just takes out the access content requirement, maybe @steve.klingele could test it out?

I opened a new issue so we can work on ways to force fboauth to respect Drupal's user creation settings: http://drupal.org/node/1305784

steve.klingele’s picture

Unfortunately that patch doesn't help by itself. However if I also add this callback requirement (adopted from the fbconnect module) 'access callback' => 'user_is_anonymous', the user account is created and access is granted.

quicksketch’s picture

Status: Needs review » Needs work

The access callback needs to return TRUE even if the user is logged in, since you can bind a FB account to your account through the same button. Other actions that might be written in the future through the API (invite my friends, import photos, etc.) would also need the path to be available for authenticated (and anonymous) users.

In Drupal 6 you could just set "access callback" => TRUE, and it would grant access all the time to everything (which is what we want). But I'm not sure that approach works in D7.

areynolds’s picture

No, I think you're right @quicksketch, it still works that way on D7. For some reason I thought it defaulted to TRUE and was optional. Here's the updated patch.

areynolds’s picture

Status: Needs work » Needs review
steve.klingele’s picture

Status: Needs review » Reviewed & tested by the community

Thanks - that patch worked.

quicksketch’s picture

Status: Reviewed & tested by the community » Fixed

Thanks guys, committed to both branches.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.