Organic Group Forum entries visible outside of group

I had the same problem. I prevent the node from showing (drupal_access_denied()) with a little code in og_forum.module -> og_forum_nodeapi() -> case 'view' -> if ($page) ....
And I copied the blocks from forum.module and modified the sql-statement to check if the user is member of the group.

Greets, Ph.

Is this happening when you have set the forums to be private? Public forums should list public posts. OG should be handling the node permissions. Make sure you added the code to OG from the README. However, the code won't be needed in the next version.

@philister I'd like any code as well.

Hi,
sorry meible for the late answer.

Here is the code for case 'view':
global $user;

if ($node->tid != 0) {
  $gid = og_forum_gid_from_tid($node->tid);
  if ($gid) {
    if (!array_key_exists($gid, $user->og_groups) && ($user->uid != 1)) {
      if ($teaser) $node->title='';
      else return drupal_access_denied();
    }
  }
}

(I cant remember why I used that if ($teaser))

And in the blocks I replaced the sql by

global $user;

$oggroupswhere = ' AND (o.nid IS NULL'
                 .(empty($user->og_groups)?'':(' OR o.nid IN ('.implode(',',array_keys($user->og_groups)).')'))
                 .')';
$sqlstring = '
  SELECT n.nid, n.title, l.comment_count 
  FROM {node} n 
  INNER JOIN {node_comment_statistics} l 
    ON n.nid = l.nid
  LEFT JOIN {term_node} t
    ON t.nid=n.nid
  LEFT JOIN {og_term} o
    ON o.tid=t.tid 
  WHERE n.type = \'forum\' AND n.status = 1 '.$oggroupswhere.' ';			

(Both code-snippets not really tested)

Another question:
In the code from the the README; why the adding to og_ancestry depends off a true variable 'og_audience_required'?
I needed a awkward long time to find out, why the forum-topics were not added to the og_ancestry.
The point is, that I dont want to make the user to define a audience explicitly. But (of course) I want a group-forum-topic associated to the group.

Thanks and regards, Ph.

Hi, I am having the same problem yet (considering that this is not new).

Can I go further in the discussion? In my point of view, if the admin user had set the group to be private since its creation, I consider that he expects that everything inside his group becomes private automatically, including the information inside this topics and comments.

I discovered that working also by doing a direct check, putting ?q=node/xx (that points to a private forum topic).

@Paul

When you say "When you have joined the group all posts are no longer being marked as private.", what do you mean? Do you mean private posts in a public forum? I thought this was working. I think it would be most helpful to base this discussion around the section titled "FORUM PUBLICITY ADMINISTRATION" in the README where the expected behavior is described. Or, if it's easier for you, simply change the code until it works as described. Since I'm not checking D.O every day, email me if you've added further comments here.

I was thinking if, to solve this issue, it could be possible to assume the topic content type as a group post. It'd be needed to solve the private/public publication issue (since OG and OG Forum have them separately), and considering that OG publication works better (no access to any node really) than OG Forum (no access to conteiner and forums' taxonomy but we may see the node), it'd be a great joining.

Hi Paul,

Sorry, I didn't understand what you meant about OG Access Control, are you talking about the ACL module?

Anyway, for the site Access Control, I have both permissions of OG Forum ("admin own group forums" and "make forums public") enabled for all authenticated users.

Mine is enabled.

I have the same problem -- og_forum posts to a private group are viewable in Recent Changes, and they are also emailed to all users by the Notify module.

I'm running Drupal 5.10, Organic Groups 5.x-7.3, og_forum 5.x-2.2, and Notify 5.x-1.1.
I have enabled: OG, og_access_control, og_forum
In site Access Control, I have both permissions of OG Forum ("admin own group forums" and "make forums public") enabled for authenticated users.
At admin/og/og_forum I have checked both "Automatic forum publicity" and "Allow public choice."

You can see for yourself. Go to http://test.nccommunities.org/ and click "Recent changes." Click "This is a forum post in the Private group" and you'll see the forum post to the private group -- node 68.

The OG module works correctly. Click "second Group post 9/29/08" and you'll see the access denied message -- node 67.

I thought this was a Notify problem and posted a comment on an issue at http://drupal.org/node/160720. They replied that "Notify checks node_access() before including a node in an email..."

The node_access table contains:
| nid | gid | realm | grant_view | grant_update | grant_delete |
| 67 | 58 | og_subscriber | 1 | 0 | 0 |
| 68 | 0 | all | 1 | 0 | 0 |

Reopening. The problem still exists as I described it, #19 above. However, I deleted the posts above and did it again so it would be clean for you to look at. The forum post can be viewed by anonymous users in Recent Change and in Recent Posts and was sent to user hallman (who is NOT a member of the group) by the Notify module. You can see this on http://test.nccommunities.org/. Without logging in, Recent Changes and Recent Posts will show you node/96:

First post to private group forum by user demo, 11/02/08
Mon, 11/03/2008 - 18:01 — demo
This is a post to the private group forum by user demo, 110/02/08

You can login as demo with password demo to see what a member of the group sees.
The group page is node/94.
I created a content type Group Post that only goes on group pages and created a Group Post, node/95. It goes on the group page and nowhere else.
Then I created a forum post, node/96.
User hallman, who is not a member of the group, received notification via the Notify module, with full content:

7. First post to private group forum by user demo, 11/02/08
Published Forum topic by demo
[ http://test.nccommunities.org/node/96 ]

This is a post to the private group forum by user demo, 110/02/08

So non members get forum posts by email through Notify and can view them from Recent Changes or Recent Posts.

I reported this as a problem to the Notify project and they said "Notify checks node_access() before including a node in an email..." Should Notify be checking somewhere else?

select * from node_access; gives

| nid | gid | realm         | grant_view | grant_update | grant_delete |
|  94 |  94 | og_subscriber |          1 |            0 |            0 |
|  95 |  94 | og_admin      |          1 |            1 |            1 |
|  95 |  94 | og_subscriber |          1 |            0 |            0 |
|  96 |   0 | all           |          1 |            0 |            0 |

I wonder if this problem is related to the ancestry problem, http://drupal.org/node/321148
On my site I have:

select * from og_ancestry;
+-----+-----------+-----------+
| nid | group_nid | is_public |
+-----+-----------+-----------+
|  95 |        94 |         0 |
+-----+-----------+-----------+

og_access is enabled.

I'm running Drupal 5.12, Organic Groups 5.x-7.3, og_forum 5.x-2.2
I have enabled: OG, og_access_control, og_forum
At admin/user/access I have both permissions of OG Forum ("admin own group forums" and "make forums public") enabled for authenticated users.

Organic groups access configuration:
- Visible only within the targeted groups.
- Group administrator chooses whether her group homepage and audience are private or not. Defaults to public.

Organic groups configuration:
- Group creator chooses whether her group appears in the directory.
- Group creator chooses whether her group appears on the registration form.
- New members are not subscribed to group email notifications by default.
- "Audience checkboxes" is unchecked
- "Audience required" is optional
- OG: Group home page - River of news.

Organic groups forums:
- Default forum name: General discussion
- Checked "Would you like all group forums to be placed in the same container?" -- container is "Group forums"
- Forum publicity administration: I haven't selected any of the options.
- Limit number of forums per group: 0

Can you think of any other settings I should check?

Is there anything I should look for in the database tables?

I think I can insert print statements in code, but I don't know what I'm looking for.

Is this issue with displaying posts in public groups only related to OG_forums or also an issue with OG itself?

If I understand it correctly, the main concern is that when a group is marked as public, it is confusing that it shows posts as "private", as that can be misunderstood and actually "fool" people into posting something they think is private to the group into a group they have forgotten or not noticed is indeed public?

Is it a matter of choosing a different term, or make an emphasis on this fact whenever someone ticks the private tick mark? Could some AJAX help inform users "live"?

I assume that posts marked private in private/closed groups are indeed not visible to anyone outside the group, in any circumstance?

BTW: could anyone give me a tip as how to establish OG on an existing site and with one operation put EVERYTHING in that site into a closed private group? Some SQL/db command is ok if not possible through the GUI. I intend to open up the existing content to new users on the site bit by bit as it is moderated/reviewed. So I want to block access to it initially. Can OG_forum module do this? Or OG itself?

Yes,
I have Drupal 6.6 with OG 6.x - 1.0 and OG Forum 6.x - 1.0 Beta 1.

A user U1 create a private group G1. The group is not listed. And set as Private. I check using other user, U2, the group is not listed.

Then back as user U1, i post a forum topic to group G1. It is posted to group G1. I check using user U2, i can see it. I can open it and can comment.

Furthermore, i try to set Forum Topic as standard posting to Organic Group. But when i create a forum topic, no Group is listed, the visible check box is only Public.

Any pointer ?

After hunting in the desert,
I find an interesting 'trace' by modifying hook_form_alter() in og_forum.module

ORIGINAL :
function og_forum_form_alter(&$form, &$form_state, $form_id) {
// Auto-select group's forum when adding/editing a forum topic
if ($form_id == 'forum_node_form') {

MODIFIED :

function og_forum_form_alter(&$form, &$form_state, $form_id) {
// Auto-select group's forum when adding/editing a forum topic
//if ($form_id == 'forum_node_form') {
if (false) {

Yes it is not yet solving all the problem. Now, on Groups, i can see to which Group a user can post. For example i select G1, then now it is only appear in G1.
No other user can see in their post.

AND ? and this which also a problem before :
Previously although all user can access a Forum Topic, bur it is not listed in the Forum.
Now the Forum Topic is listed in the Forum belong to G1.

I am not saying thats changes is a final solution. It is abandoning too many lines of codes. It is only a trace, a clue ... for further hunting.

Hate to reopen an issue, but I am still having this problem. I am using OG 6.2.RC3 and OG-Forum 6.2.RC1 (was having issue with http://drupal.org/node/549542), so had to use an older version.

Here's the problem. Users outside the OG can't see the forum containers, however the forum topics are displayed on the 'New Topics' block. And when they click on a new topic, which is in a group they're not members of, they can see the post and reply to it.

I have OG Access Control enabled. Any help?

I had this problem as well, and evidently in my case the problem was the use of multiple access control functions and their priority with respect to one another.

Comment #7 at http://drupal.org/node/554132 solved my problem. For the content types group, group post, and forum topic, I set the priority in Access Control >> advanced to -10, then rebuilt the content access permissions.

@janam - I had exactly the same issue (#35). I checked my Forum topic content type, and it was set to 'May not be posted into a group'. I changed it to 'Standard group post' and everything now works as advertised. I had to go back to each topic that was already published and resave it to get the new type to grab (there's probably an easy way to do this in MySQL, but we didn't have that many topics yet to bother figuring it out).

I don't think that's documented anywhere in the set up instructions. Though it may be obvious in retrospect, it would have been helpful for that to be explicit up front.

Hope that helps.

Looks like you can still view the forum comments, but not the forum itself, in other words, it will correctly deny access to the OG forum, but you can still hit up the comments directly

Actually no wait, You need to ensure that a 'forum' is configured to be a OG Node post type, I incorrectly assumed that this was something already taken care of by OG forum

#36
had the same problem - with weight -10 it works for forum topics type and group posts type.
But I did not set -10 for group type itself.

#39
as far as I can say it is not necessary to active groups for forum topic type to work.
Do you use Access Control or other Access Module? It is tricky to set the weights right.

Just want to reiterate what I had to find out the hard way,

Actually no wait, You need to ensure that a 'forum' is configured to be a OG Node post type, I incorrectly assumed that this was something already taken care of by OG forum

This really should be documented on the front page in big bold letters.