Hi, This is a great module. It's enabled me to restrict content in a very clean way.

I am trying to use these rules within groups and it appears that the access provided to groups is overriding these rules. Maybe there's something I'm missing in the configuration?

I have two roles: Contractor and Client

Content type:privatemessagebetweencontractors is designed to talk w/out the client being able to see the exchange.

All works well until i create a group Project1, when two contractors and the client are all members of the group, and the node is created w/in the context of the group, the client can see the node by virtue of being the member of the group, even though the content type is restricted to role "contractor."

...and the client is only role "client"

Is there some config i'm missing, or is this a feature request? Maybe it's a feature request that OG respect these roles? I couldn't find a place in OG to make it aware of byrole. There are permissions in OG but they are by group, not by role, which wouldn't work because i want to have many many groups (proj1, proj2, etc.) and maintain this same permission structure.

Thanks in advance for your guidance.
/TL

Comments

deekayen’s picture

deekayen commented
Status: Active » Closed (works as designed)

You're just discovering that the Drupal permissions system is generous. You don't have access until something gives you access, then there's no higher level that takes it back away. With NPBR, you don't have access until NPBR grants you access, but then OG is granting access in your case by virtue of being a group member and NPBR can't take it away.

ACL with Content Access acts in almost the same way as NPBR with different configuration interfaces, however I think you'd find it would work in the same way.

I would rather not hack core to create another hook to take away permissions that were granted by another module. I don't have a good answer for you. At the least, it's a feature request.

tlash’s picture

tlash commented
Status: Closed (works as designed) » Active

Though I had been looking in the forum for hrs, after posting I ran across the following thread:

Simple Node-Privacy-By-Role question (with Organic Groups)
http://drupal.org/node/45114

...which states that one set of permissions will work at a time. I guess at this point I'm hoping that because this issue is a couple of years old somebody has come up with a workaround. Now i'm thinking that subgroups MIGHT help but there are various simultaneous subgroups so it will be hard to administer that long term.

Any suggestions would be appreciated.

thx,
/TL

deekayen’s picture

deekayen commented
Status: Active » Closed (works as designed)

It's not entirely accurate that only one set of permissions works at at time. I'm part of running a site that uses Workflow Access, NPBR, and Workflow Fields at the same time on the same nodes. It's just a matter of setting up the correct permissions in each.

In your case, what you'd want maybe is to grant certain people access to be a member of a OG group, but not see any of the content, then set the node access permissions with NPBR. That's probably not possible with the way OG works (my only use of OG is browsing groups.d.o).

If you can do that, you'd probably have to have create a new pair of roles for each group.