Eg, node/add/post.

CommentFileSizeAuthor
#21 1910874-anon-create-content-20-a.patch768 bytesezra-g
#21 1910874-anon-create-content-20-b.patch2.47 KBezra-g
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

ezra-g’s picture

ezra-g CreditAttribution: ezra-g commented

This appears to be related to commons_groups_og_user_access_alter().

ezra-g’s picture

ezra-g CreditAttribution: ezra-g commented

I committed a fix with an extensive code comment:

// We do a literal user_access() check on the create permission here
// because we can't call node_access() without causing recursion.
// The code flow is:
// node_access()>og_node_access()=>og_user_access_entity=>og_user_access=>
// og_user_access_alter()=>commons_groups_og_user_access_alter().
// See also: http://drupal.org/node/1910874.

Ultimately it's difficult to provide a highly specific node access scheme (non-group member authenticated users able to post into public groups without being a member, but not if the group is private) while retaining the ability to work with every conceivable permutation of node access configuration that site-builders might implement.

This fix will observe the site-wide "create x" permission as returned from user_access() in public groups.

Let's address compatibility with configurations that don't match the Commons use-case as they come up.

http://drupalcode.org/project/commons_groups.git/commitdiff/79f869c?hp=5...

ezra-g’s picture

ezra-g CreditAttribution: ezra-g commented
Status: Active » Fixed
jayjaydluffy’s picture

jayjaydluffy CreditAttribution: jayjaydluffy commented
Status: Fixed » Active

i just updated from beta2 to beta3 in hope of having this issue fixed but sadly it's still there. it's only disabled when 'View published content' is turned off. but i want visitors to read the posts.

any suggestions?

jayjaydluffy’s picture

jayjaydluffy CreditAttribution: jayjaydluffy commented
Version: » 7.x-3.0-beta3

sorry

ezra-g’s picture

ezra-g CreditAttribution: ezra-g commented
Assigned: Unassigned » ezra-g

I'll take another look at this.

ezra-g’s picture

ezra-g CreditAttribution: ezra-g commented
Status: Active » Postponed (maintainer needs more info)

I'm not able to reproduce this. Does it happen on a fresh install of Beta3?

jayjaydluffy’s picture

jayjaydluffy CreditAttribution: jayjaydluffy commented
Status: Postponed (maintainer needs more info) » Active

I'm not able to reproduce this. Does it happen on a fresh install of Beta3?

No, not on a fresh install beta3. It was an "update" from beta2 - i only did a manual update because there seems like a problem in updating Commons with drush (i think Commons cannot locate the internal modules directory).

Maybe I should try doing fresh install just to see the difference. But I have done alot already to start anew. In that case, how should we fix it? Any suggestions? I already rebuilt permissions, did a lot of running cron and clearing cache but still not fixed.

Here's a screenshot:
http://screencast.com/t/B2QZUXDwHcmb

Thanks!

ezra-g’s picture

ezra-g CreditAttribution: ezra-g commented
Status: Active » Postponed (maintainer needs more info)

Yes - Please try to reproduce on a fresh install and report back.

Also, it's posible your manual upgrade steps are part of the problem. Did you verify that you applied all the patches and used the same module versions specified in the Commons make file?

Dani_what’s picture

Dani_what CreditAttribution: Dani_what commented

I had this issue in beta3 and have it now too (after upgrade). Anonymous users CAN'T access the /groups page, but can access group nodes and both create and edit ANY content.

Worse yet, anonymous user sees the "Unsubscribe from group" link in the groups pages (why is it subscribed?). If I hit the unsubscribe link then I can't create or edit content, except the wikis, and after editing a wiki then I'm again subscribed to the group it belongs to.

jayjaydluffy’s picture

jayjaydluffy CreditAttribution: jayjaydluffy commented
Version: 7.x-3.0-beta3 » 7.x-3.0
Status: Postponed (maintainer needs more info) » Active

i just upgraded to the final release (3.0) from beta3, applied all database updates but STILL get the same problem.

like you recommended, i installed a fresh final release of Commons and investigated both sites' node access (ss below showing DNA info of one of the pre-created event/s "Ribfest Boston 2013") using Devel NA and i found this:

fresh install - http://screencast.com/t/KROw5Vrz1V
upgraded - http://screencast.com/t/fWrV11t4yZ

i still get the same even after i adjusted the permissions (og and general) of upgraded, making it the same with the fresh install.

when hovering the "YES: by og" on DNA table of upgraded site it says "YES: hook_node_access of the ff module(s) allows this: OG". I manually checked the database but found nothing wrong.

can you please help me? thanks!

PS - the final release was really COOL - lost of CSS fixes and additions! thanks!

jayjaydluffy’s picture

jayjaydluffy CreditAttribution: jayjaydluffy commented

for now used hook_node_access()

japerry’s picture

japerry
Location KVUO
CreditAttribution: japerry commented
Assigned: ezra-g » japerry

Trying to reproduce now. To be clear, this bug does not occur on fresh installs.

We've committed to having an upgrade path from stock Beta2 to 3.0, but any additional modules installed could cause issues with this upgrade path.
I'm currently looking at the Beta2 -> Beta3 -> 3.0 upgrade path and will report back.

japerry’s picture

japerry
Location KVUO
CreditAttribution: japerry commented
Status: Active » Fixed

For some reason, anonymous users can be considered members of a group, even though they aren't showing up as such in the database. I added an additional check specifically for anonymous users to make sure that unless they have 'create X content' permission enabled, they cannot make a post.

Fixed in this commit, it should force permissions on anonymous users:
http://drupalcode.org/project/commons_groups.git/commit/f3a58c1

ezra-g’s picture

ezra-g CreditAttribution: ezra-g commented
Issue tags: +Commons 7.x-3.1 radar

Adding to the Commons 7.x-3.1 radar.

ezra-g’s picture

ezra-g CreditAttribution: ezra-g commented
Title: Anonymous users are able to create content » Anonymous users are able to create content (Beta=>3.x stable only)
ezra-g’s picture

ezra-g CreditAttribution: ezra-g commented
Title: Anonymous users are able to create content (Beta=>3.x stable only) » Anonymous users are able to create content (Beta=>3.x stable upgrades only)
ezra-g’s picture

ezra-g CreditAttribution: ezra-g commented
Assigned: japerry » ezra-g
Status: Fixed » Needs review

Re-opening to double triple check this.

ezra-g’s picture

ezra-g CreditAttribution: ezra-g commented
Status: Needs review » Needs work

After some additional research and coordinating with japerry, we reverted the commit from #14: http://drupalcode.org/project/commons_groups.git/commitdiff/34248ec?hp=7....

It seems like the problem for upgrading users is likely caused by a bug in Beta2 where anonymous users were able to create content. When a user posts into a group where she is not already a member, Commons Groups adds the user as a member. With the bug in Beta2, the anonymous user was added as a group member, giving all anonymous users access to post into groups, even when the original issue with Commons Groups' hook_og_user_access() implementation was fixed.

We can help affected sites upgrading from Beta2 by deleting the erroneous membership of the anonymous user. Leaving open for this work, as well as preventing anonymous users from being added as groups members automatically by Commons Groups in the future.

In the interim, advanced site admins should be able to fix this bug by deleting any entries in the {og_membership} table where etid = 0 and entity_type = user.

ezra-g’s picture

ezra-g CreditAttribution: ezra-g commented

Also, we can remove the hook_og_user_role_insert() implementation and just set the "Select the role(s) a group manager will be granted upon creating a new group." setting at "admin/config/group/settings".

ezra-g’s picture

ezra-g CreditAttribution: ezra-g commented
Status: Needs work » Needs review
FileSize
1910874-anon-create-content-20-b.patch2.47 KB
1910874-anon-create-content-20-a.patch768 bytes

The attached patches implement the fixes described in comments 19 and 20.

Note that one patch moves the OG settings update from commons.install to commons_groups.install.

japerry’s picture

japerry
Location KVUO
CreditAttribution: japerry commented
Status: Needs review » Reviewed & tested by the community

Looks good to me! the update will run again, since we've moved which install file it is in.. but all that'll do is reset the name. It could be annoying if anyone changed the 'Organizer' role to be something else, but thats a really small edge case.

ezra-g’s picture

ezra-g CreditAttribution: ezra-g commented
Status: Reviewed & tested by the community » Fixed

Committed - Thanks for the review!

If you're still affected by this behavior after upgrading to tomorrow's nightly dev of Commons and running updatedb/update.php, please re-open this issue.

http://drupalcode.org/project/commons_groups.git/commit/383e202
http://drupalcode.org/project/commons.git/commit/cbae966

Automatically closed -- issue fixed for 2 weeks with no activity.