I am having a problem where some users are not seeing all of the forums on the main forum page. If they link directly to the forum they do have access and can view posts but the forum does not appear on the main page. I cannot imagine why this is happening, any ideas? Looking at the database it seems the forum_access table has all the correct permissions for their role.

-Drew

Comments

salvis’s picture

salvis
he/his
commented
Category: bug » support

No, no ideas. This works. Check the forum setup of one of the forums that doesn't work as intended.

drubage’s picture

drubage commented

The issue must be related to roles and access somehow. I have set up moderators for various forums and also created the roles "Forum Moderator" "Community Administrator" and "Piercer". I have given the "Piercer" role view and post permissions for the piercer forum and that is working. I have gived the "Community Administrator" and "Forum Moderator" roles permissions to view and post in the moderator and piercer forums but neither forum shows up in the list of forums for either role.

-Drew

salvis’s picture

salvis
he/his
commented

Quoting the just created submission guidelines:

For any issue, always post the path (URL) that is causing problems: what's the page where your forums are missing?

We may be able to debug this indirectly: pick one missing forum, create a post in that forum, then report all the node access records for that node according to the following:

If you have nodes that should be accessible but aren't, or vice versa, then

  • update Forum Access to 5.x-1.9 or later
  • update ACL to 5.x-1.x-dev
  • download the Devel module, 5.x-1.x-dev and install the devel_node_access module
  • enable the Devel Node Access block in the footer region
    (updating the modules will show you explanations of the node access records)
  • pick one node that is misbehaving and copy/paste all its node access records as shown by Devel Node Access
drubage’s picture

drubage commented

Thanks so much for your help. The forums are here:

http://www.tribalectic.com/Drupal/forum

I added the devel_node_access module and block as you described. When I am looking at a forum I don't see the access info listed at all. If I look at a post in the moderators forum I see this:

node_access entries for nodes shown on this page
node realm gid view update delete explained
0 all 0 1 0 0 All users may view all nodes.
Welcome! forum_access 6 1 1 1 admin
Welcome! term_access 6 1 1 1
Welcome! forum_access 18 1 1 1 Forum Moderator
Welcome! forum_access 19 1 1 1 Community Administrator

I had to add the "0 all 0 1 0 0 All users may view all nodes." line in relation to this issue here:

http://drupal.org/node/134505

But I will remove it by re-doing the access rules for all nodes later today (it removes all access rules and all content disappears while it is running and I don't want our site members freaking out as we have over 30,000 nodes). If a person has rights to view posts in the moderators forum I would assume that that forum would show up on the forum page for that user but it does not.

-Drew

salvis’s picture

salvis
he/his
commented

Yes, the node access information only applies to nodes, not to the forum list. That's why I asked you to create a post.

I see that you have a 'term_access' record — are you using Taxonomy Access Control along with Forum Access? I'm not sure whether the two modules are compatible.

Adding the

"0 all 0 1 0 0 All users may view all nodes."

row is not a solution — it only covers up mis-configurations! And it only affects nodes, it can't make your forums visible.

Go to the configuration page of your forum and give the anonymous user View access, if that's what you want.

If a person has rights to view posts in the moderators forum I would assume that that forum would show up on the forum page for that user but it does not.

"All users may view all nodes." does exactly what it says. All users may view all posts in your moderators forum (as well as in all other forums and everywhere else). But just because you've broken part of your access control does not mean that it's completely broken. The forums page continues to be filtered as you've configured it.

P.S. The page you cite is a classic case of the blind leading the deaf...

drubage’s picture

drubage commented

I understand that is not a solution, I just need to rebuild the node_access table (it just takes a long time) for the nodes to have correct permissions. The node_access table seems to get corrupt if I make any changes to user roles (like change the name, erase a role, add a role). Once I rebuild the node_access table only those users with certain roles will be able to see the content in restricted forums.

Anonymous users do have view rights and can see all of the forums that I want them to see. The problem I am having is that I am using forum_access to give view and post permissions to some of my roles in the "Moderator Forum" but those roles are still unable to see the moderator forum. However, there is another forum in another container called the "Piercer Forum" and everyone who I have given the "Piercer" role to sees that forum fine. I am using the same setup for the "Piercer Forum" and the "Piercer" role as I am using for the "Moderator Forum" and the "Forum Moderator" and "Community Administor" roles but those 2 roles are unable to see the "Moderator Forum".

I am trying to uninstall the Taxonomy Access Control module but it will not remove the page just loads and loads and it never removes.

-Drew

salvis’s picture

salvis
he/his
commented

I am trying to uninstall the Taxonomy Access Control module but it will not remove the page just loads and loads and it never removes.

That's because TAC forces a permissions rebuild. Try disabling FA and ACL, but don't rebuild permissions. Then try removing TAC. This should leave you with nothing but the

"0 all 0 1 0 0 All users may view all nodes."

record. Then you can re-enable FA and ACL.

drubage’s picture

drubage commented

Aha. Well I needed to rebuild that list anyway so I removed it and the problem seems to be fixed! Thanks so much for your help, amazing!

-Drew

salvis’s picture

salvis
he/his
commented

Is this...

Welcome! forum_access 6 1 1 1 admin
Welcome! term_access 6 1 1 1
Welcome! forum_access 18 1 1 1 Forum Moderator
Welcome! forum_access 19 1 1 1 Community Administrator

... for a post in the Moderator forum?

Unfortunately, TAC doesn't know how to explain its gid yet. For FA, the gids are just rids (role IDs). 6 stands for your 'admin' role. term_access also shows a 6, so maybe TAC's gids are also rids. If that's the case, then you're missing term_access entries for Forum Moderator and Community Administrator.

Look at a post in your Piercer forum and compare the node access entries to check whether it conforms to this wild theory. Does the Piercer Forum have a term_access entry with a gid that is the same as the rid of your Piercer role?

To really know what the TAC gids mean, ask the TAC people, and while you're at it, tell them to implement hook_node_access_explain(), so that we can see instead of having to ask.

salvis’s picture

salvis
he/his
commented
Status: Active » Fixed

The node_access table seems to get corrupt if I make any changes to user roles (like change the name, erase a role, add a role).

This should not happen. Since you had FA and TAC installed and presumably no other node access module, one of these two is the likely culprit. If you keep TAC disabled and this ever happens again, then PLEASE come here and let's look into to.

drubage’s picture

drubage commented

Here's what it says for a post in the piercer forum now:

node_access entries for nodes shown on this page
node realm gid view update delete explained
Feedback forum_access 3 1 0 0 piercer
Feedback forum_access 6 1 1 1 admin
Feedback forum_access 8 1 1 1

Here's a post in the moderator forum:

node_access entries for nodes shown on this page
node realm gid view update delete explained
Welcome! forum_access 6 1 1 1 admin
Welcome! forum_access 18 1 1 1 Forum Moderator
Welcome! forum_access 19 1 1 1 Community Administrator

Looks good! Another question, moderators through FA only have access to edit the main post, any idea when they will be able to edit comments only in their respective forums? I had to create a role called "Forum Moderator" that can edit comments but they can edit all comments, not just the ones in their forum.

-Drew

salvis’s picture

salvis
he/his
commented

This line

Feedback forum_access 8 1 1 1

bothers me a bit. Has your role rid=8 no name???

Getting FA to properly deal with comments is on my TODO list, but I can't make any promises when this will be.

drubage’s picture

drubage commented

Hm, I don't see any role 8 in my role list. I don't see it in the roles table either. Any ideas?

-Drew

salvis’s picture

salvis
he/his
commented

I don't know. That role has/had full access, like 'admin'. Can it be a role that you've deleted?

Is rid=8 in your {forum_access} table?

I'm on the road right now, so I can't test whether FA properly deletes grants when a role is deleted, but I'll definitely look into it.

drubage’s picture

drubage commented

Yes, I think it was a role I had created before but then erased. It was a community administator role that had all permissions on all forums. I have rebuilt permissions since this role has been deleted (and other roles have been added/edited/deleted in the meantime)

-Drew

salvis’s picture

salvis
he/his
commented

I've now verified that deleted roles aren't removed from the {forum_access} table, but this does not compromise security in any way, so it's nothing to worry about.

I've created a task for myself at http://drupal.org/node/219778 to clean this up.

Anonymous’s picture

Anonymous (not verified) commented
Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.