Hi,

I find it very good that non-members can post too in groups, but why do they become members?
That's the way it should be? How can i disable this?

The problem is that if i have a group with public and private content(non-members can see just public content) and a non-member postes for example a "Post" in the group, than he becomes a member of the group ---> he can see private content too. So there's no reason to have private content.

I would be very thankful for some explanation why is it so, and for a solution.

Comments

ezra-g’s picture

ezra-g commented
Title: non-members post in group become member » Non-member of private group able to post content into the group
Status: Active » Postponed (maintainer needs more info)

Commons allows users to post content into groups that are public without manually joining first since this is an unnecessary step.

If non-members are able to post into private groups then this is a bug - Is that what you're saying is happening? If so, can you post steps to reproduce?

Laz5530’s picture

Laz5530 commented

No its not a private group.

I have a group with "group visibility = public" and "group content visibility = public"(so non-members can post too in this group)
In this group i have a "PublicPost" with "group content visibility = public"(so can everybody see this post)
and i have a "PrivatePost" with "group content visibility = private"(so can just group members see this post)

If i'm not member of the group, i can see the "PublicPost" and i see the "Create Post" link.
If a klick on the "Create Post" link and i make a new post, then i will automaticly became a member of the group.
Because i'm now member of the group, i can see the "PublicPost" and the "PrivatePost" too.

ezra-g’s picture

ezra-g commented
Title: Non-member of private group able to post content into the group » Remove 'Private to group members' option when posting into a public group
Category: support » bug
Status: Postponed (maintainer needs more info) » Active

Thanks. If I understand correctly, there's no actual privilege escalation here -- Eg, you can't trick the system into allowing you to become the member of a private group.

I think the action item here is to remove the post visibility option for public groups since it is confusing. Does that make sense to you?

Laz5530’s picture

Laz5530 commented

Yes, in this fall there's no reason to keep the visibility field for post, because it can be tricked out.

But the bigger problem is that the user became a member without "admin-approval".

My goal is to have a group where everybody can post(without becoming a member) but it has private content too.

An stupid example-use-case: I have a group "Beer Masters" where everybody(without membership) can write a post "my favorit beer is...xy".
The members of this group summerize this posts and write a post "the most favorit beer is...xy", but they want to keep this in secret so just the other members can see it so they make it a post with visibility: private.
So if a non-member write a post(--> becomes a member-->) then he will be able to see what the favorit beer is(what should remain a secret).

Do you know what i mean?

druser01’s picture

druser01 commented

csotlac,
I have a similar requirement and used jquery to check the visibility type and then hide or show the membership types(requires group owner approval or not) accordingly.

ezra-g’s picture

ezra-g commented
Project: Commons Groups » Drupal Commons
Version: 7.x-3.x-dev »
Component: Group Privacy » Code

Moving to the main Commons queue.

lsolesen’s picture

lsolesen commented
Version: » 7.x-3.x-dev
Issue summary: View changes