Hi,

Query requests don't work with organic groups entities when the query parameter is the og_group_ref entityreference field. e.g. http://example.com/node.json?og_group_ref=123 returns 404 not found.

Steps to reproduce:

  1. Do a clean Drupal installation
  2. Install restws and organic groups modules.
  3. Create a "Group" and a "Group content" content type.
  4. Create a group node
  5. Create a group content for the Group that you created in the previous step
  6. Go to http://example.com/node.json?og_group_ref=GROUP_NID . You'll get 404 Not Found: Page doesn't exist.

I also checked to see whether this is a general problem with entityreference field or not (og is using entityreference to manage group and group content relationships). But the entityreference query requests work on non-group entities.

Comments

Roeneman-1’s picture

Roeneman-1 commented

Run into this today as well and solved it by inserting the group node nid as 'id' into RESTWS via hook_restws_request_alter.

Problem seems to be that when making a query, RESTWS does not send an entity id (for instance a node nid) to entity_access. As a result entity_access determines whether the user has access to all entity's of the same kind (same bundle I believe). That is typically FALSE when you have OG installed, so access is denied.

As a solution I found 'hook_restws_request_alter' to be helpfull.
When I insert NID for which the access rights should be checked through that hook, my access denied issue is solved.

So put something like this in a module:

hook_restws_request_alter($request){
     if(empty($request['id']) && isset($_GET[ARGUMENT WITH CORRECT ID])) $request['id'] = $_GET[ARGUMENT WITH CORRECT ID]);
}

So it is not really a bug, it seems to be by design. And the solution is not really difficult and typically something that needs to be tailor made for every access module and site, I think.
But a watchdog notice pointing me into this direction would have been helpfull, so if I may issue that as an improvement.

Rgds, Roeneman

btopro’s picture

btopro commented
Issue summary: View changes

Somewhat related: A lot of times using restws w/ OG based systems (while UUID is on) bricks calls for nodes that relate to groups. This patch resolves that: https://drupal.org/node/1927474