You can't actually make an anonymous/authenticated home page without people being able to view (public) content. :)

CommentFileSizeAuthor
#6 20121023-msrmbtidgdrs6usqme3cat67gb.jpeg126.59 KBezra-g
#2 commons-anon.png147.53 KBwebchick

Comments

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
commented

Also, I am probably not going to be able to work on this, because I am not sure where said permission assignments would go. I'm used to doing them in $distro . '_install()'; but that doesn't seem to be the proper place in Commons.

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
commented
Title: Turn on "view published content" permissions for anonymous && authenticated users » Anonymous users see 403 everywhere, but can still see titles of things
StatusFileSize
new commons-anon.png147.53 KB

Yeah, these permissions are still funny. Here's what the logged out user sees on the home page:

Titles showing of activity stream, pages but no content available.

This is un-good, because if I'm truly not meant to see those things I should not see them in the interface. A title of one of those activity stream things might be "Acquia to acquire Microsoft later this month. Keep confidential." (I kid, I kid... but seriously. ;))

All of these things look like they need to be run through X_access(), and since I can't associate pages with a group, it seems like at least those should be public because otherwise I can't view the "how to register" page or whatever.

ezra-g’s picture

ezra-g commented
Title: Anonymous users see 403 everywhere, but can still see titles of things » Enforce node access restrictions on Activity stream entires
Component: Code » Activity/status streams

Re-titled with the action item to fix this.

I see a few ways of handling this:

A) Since Commons defaults to having only public groups, we can not write activity stream messages about unpublished nodes, and unpublish messages when nodes are unpublished.

B) Implement proper node access on activity stream entires. This is the most robust solution but comes at the potential performance cost of additional node access checking.

ezra-g’s picture

ezra-g commented

I created #1813398: Turn on "view published content" permissions for anonymous && authenticated users as a separate issue.

meba’s picture

meba commented

I think B is the right choice since you never know where content bubbles up. Messages are entities so content access on them shouldn't be hard. We could also implement the D7 hook that allows us to check access for anonymous users without an expensive query?

ezra-g’s picture

ezra-g commented
StatusFileSize
new 20121023-msrmbtidgdrs6usqme3cat67gb.jpeg126.59 KB

I chatted with amitaibu and he suggested that this might be simple to add to Message views, per the attached screenshot. We should do some testing :).

ezra-g’s picture

ezra-g commented
Status: Active » Fixed

This is fixed in several parts:

I rolled this patch to Views to fix a bug in the "Content access" filter:
#1822440: "Content access" filter should check for node_grants implementations before adding node access grant queries

That's added to Commons with;
http://drupalcode.org/project/commons.git/commit/6baf7fb

And the Activity stream views are updated to enforce node access via the "Content access" and "Node: published or admin" filter via:

http://drupalcode.org/project/commons_activity_streams.git/commit/ff2a5d4

Thanks, webchick for pointing this out super duper early!!!

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
commented

Awesome! :D Happy to break your stuff early anytime! ;)

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.