configure member roles permission is always on, even if unchecked

The box is unchecked and the roles drop-down still shows up.

I want to disable even the "Set default basic..." checkbox, as this won't be used at all on my site.

I can do it with form_alter, though it would be most awesome if it was tied in with the OGR settings page.

Best,
Andrey.

OK.

On the OGR configuration page, the only thing that is checked is this:

Allow Group Admins to set Registration Codes for users to join their moderated groups without admin approval?

On Access Control page, members have these permissions:

manage registration codes
use registration codes

When I edit my group as a member, I see this error on the top of the page:

warning: Invalid argument supplied for foreach() in /home/transfp6/public_html/dev/includes/form.inc on line 949.

And in the "Registration code for new subscribers to this group" fieldset, I see the following options (all unchecked/empty):

Set registration codes to allow users to join this group?
Delete registration code after it is used?
Registration codes for allowing users to subscribe to this group without admin approval:
Set default basic group (group limited) role for users who join this group using this registration code?
Role to assign:

There are a couple of problems here:
1. The error on the top of the page is due to an empty "Role to assign" drop-down.
2. I see the "Set default basic group (group limited) role..." option and the "Role to assign" drop-down, even though I have "configure member roles" disabled on the Access Control page.

I don't want to assign roles with codes, so how can I disable the last two options on the group edit page?

Set default basic group (group limited) role for users who join this group using this registration code?
Role to assign:

Please let me know if you need further clarification.

Best,
Andrey.

Hi @SomebodySysop,

I do want to use the registration codes, but I don't want to assign any special roles when I use the codes. I also don't want the error on the top of the page.

I want to have these options:

Set registration codes to allow users to join this group?
Delete registration code after it is used?
Registration codes for allowing users to subscribe to this group without admin approval:

But not these:

Set default basic group (group limited) role for users who join this group using this registration code?
Role to assign:

I thought that the "configure member roles" permission works with the reg codes fieldset, but I guess it doesn't.

Best,
Andrey.

Hi @SomebodySysop,

Hmm.. I'm not sure we're understanding each other.

In Access Control, you must give the manage registration codes permission to all roles whose users will be able to determine if a group can use registration codes, and if so, will be able to enter the codes for a group. Note that these users will also need to have the "edit group content" permission as they will need to edit the group node to check on the Set registration codes to allow users to join this group? option.

I gave the "manage registration codes" and "edit group content" permissions in Access Control. I'm not sure what you mean by this quote.

The error disappears if I check at least one role under "Group role options" on the OGR page, because it populates the drop-down.

This module allows you to, for each group type, specify a list of roles
that group administrators are allowed to assign. In the subscriber list
(og/users/), a 'configure member roles' tab will appear if both
the group type is allowed to configure roles and the current user is an
admin for the group.

I guess the "configure member roles" permission doesn't extend to the regcode fieldset. To me it makes sense that if group admins can't "configure member roles" on the special page, they also will not be able to do so through the regcodes. It seems like a security flaw, as anyone with a regcode permission will be able to create a new user and assign themselves whatever role they need, even though they don't have the permission to "configure member roles". Does this make sense?

Let me know if you want me to clarify this more.

Best,
Andrey.

Just updated to 3.1 and patched. The error goes away.

The potential security flaw of site admins asigning themselves whatever roles they want without having "configure member roles" permission remains.

I also noticed that there's a new "Logo" fieldset in 3.1. There doesn't seem to be a way to hide it. The group form is already complex, and I'm not planning to use logos. I can manually disable it through _form_alter, but inability to turn it off will probably turn some people off as well.

Andrey.

Great! Thanks for taking the time to make it all work.

I just checked, and when the "configure member roles" permission is unchecked, the member role options disappear in the regcode fieldset. This is awesome.

No worries about the logo, and though I think it's a cool feature, we're not planning to use it, so it's super simple to disable it with _form_alter.

Andrey.