For the drupal-6 versions of this module (stable and -dev) in a very simple setup with exclusive access groups A B (and roles==groups), a node that is set to be view/edit/delete-able *only* by Owner and group A stops being viewable by group B. That's expected. However, group B can *still* edit pages by going to node//edit. The same aparently does not work for node//delete. The same behaviour can be observed for all other users (not in groups A or B), i.e. view/delete access is denied, however edit still works.

After some investigation, this seems to be related - at least to an extend - to content type specific permissions on admin/user/permissions, however the interaction isn't clear here. Seems like the interactions here should be explicitely documented by the module (at leats in README) and ideally options that don't have any effect (e.g. Acces-Owner-(View/Edit/Delete) if admin/user/permissions allows all kinds of owner access) shold be disabled in the Access form.

Comments

nonzero’s picture

nonzero commented

Did you try Post settings - Rebuild permissions after changing the node's Simple Access settings?

tgmfn’s picture

tgmfn commented
Priority: Normal » Major

I observed the same problem with version 7.x-2.0-beta1 with the same setting as described above: I have two roles A and B, and one content type, where roles A and B have "edit any" permissions on. The SA access groups A and B correspond to my roles A and B. Then I make a node (e.g. 123) of my content type readable and editable by users in group A, but not readable nor editable by users in group B.

When a user in group B tries to access /node/123, he gets an "Access denied". But when he goes to /node/123/edit, he can see the usual edit page with all the node content and can even change it.

As the nodes are consecutively numbered, one may "guess" a node number, try to access /node/???/edit and thus skip one of the main functions of the Simple Access module (as long as one's role has edit permissions on that content type).

I tried that also with version 6.x-2.0 on Drupal 6 with the same effect: a user in group B can't view, but can edit a certain node.

By the way (integration with the Views module): In a Views-created list of nodes, my discussed node is listed for users in group A, but not for users in group B. That's like expected. But if I create a view "/show_node" that displays only one node (but in my favourite formatting) and a user in group B tries to access /show_node/123, he sees the node title (but no further content of the node).

P.S., referring to #1: Rebuilding permissions didn't help in any way.

gordon’s picture

gordon commented

take a look at the node using the Devel node access (and it block), and it will tell you exactly what access is being used to edit the node.

There is most likely an issue with your configuration.

tgmfn’s picture

tgmfn commented

@gordon (#3): Thank you very much for your hint. You are right and I found my configuration problem:

The fault was that roles A and B had "edit any" permissions on my content type (on the general Permissions page). If they don't have them, going to /node/123/edit (without having Update permission on node 123 by simple_access) results in "Access denied" as expected.

(Hence the edit permissions strategy is kind of contrary to the view permissions strategy presented in the module description: "Nodes that are not assigned to any access groups will remain viewable by all users, so all nodes will remain viewable when activating this module. And nodes only become private when they are assigned to an access group." You can't replace "viewable" by "editable" here. That's not a problem, but maybe helpful to mention somewhere.)

However, the problem described in my last paragraph about "integration with the Views module" in #2 remains, but that may be another topic.

gordon’s picture

gordon commented
Status: Active » Fixed

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.