In a project I am working on there is need to use Domain Access to run multiple sites off one database and to use Revisioning / Module Grants to manage content workflow. I found that under certain conditions these access control modules conflict. When I use Domain Access to publish a node "to all domains" without specifying any of them specifically, the node grants are not properly recognized by Module Grants module.

I put together a patch that fixes the problem by adding the missing grants. It works fine for me, though I am not sure if this is the best way to resolve conflict between these modules in the long run. Patch is attached, any feedback or better ideas are welcome.

CommentFileSizeAuthor
module_grants.patch1.33 KBdkruglyak

Comments

rdeboer’s picture

Thanks for the patch dkruglyak!
It seems a straightforward, non-intrusive change.
Let's see what the community has to say about it and if all remains well, I'll include in a next release.
Rik

dkruglyak’s picture

I think these conflicting modules are not used by a lot of people, especially in combination, so I am not sure how much feedback we will get. I suggest not waiting too long and just committing in. If someone has a better idea later, it can always be changed!

rdeboer’s picture

Assigned: Unassigned » rdeboer
Status: Needs review » Fixed

Committing. Development snapshot will be available later today

cdale’s picture

Status: Fixed » Needs work

This patch is not quite right. The following code:

      // Domain Access has special case with a global cross-domain grant
      if ($module == 'domain') {
          $module_gids[] = "(nid=$nid AND gid=0 AND realm='domain_site')";        
      }

Needs to become:

      // Domain Access has special case with a global cross-domain grant
      if ($module == 'domain' && $nid) {
          $module_gids[] = "(nid=$nid AND gid=0 AND realm='domain_site')";        
      }

As $nid may not exist there, and will cause SQL errors. not sure why $nid won't be there, but I experienced this myself.

So either the if $module == 'domain' part goes inside the if ($nid) check, or a check is added to the if test provided. Trivial solution, not sure which way you'd liked to go.

cdale’s picture

Actually, on closer look, this patch doesn't seem like a very clean solution. I can't exactly think of a better one, as I'm not 100% sure what it's trying to achieve. I'm relatively new to the domain module, and I'm a bit lost in it at the moment, but I do know that using the http://drupal.org/project/domain_adv module has cleaned up a lot of my issues when used with content_access(). Perhaps using that module would be a better solution?

dkruglyak’s picture

Is it even possible for $nid to not exist? In any case this looks like a minor fix.

As far as, domain_adv, I do not think we should make module_grants dependent on it. Given that it radically changes internal domain access implementation, there could be unintended consequences. Let's not de-stabilize this fix that works just fine.

cdale’s picture

It is possible for nid not to exist, because it happened to me. :) I got an SQL error because of it. Not sure where, why or how, though I was still constructing the site, so perhaps that is why it happened. Still should be fixed, even if it's a rare edge case.

I wasn't suggesting module grants depend on it, but perhaps the combination of domain and module grants would work better with it. A documentation issue.

rdeboer’s picture

The extra test for an empty nid is a good case of defensive programming at low cost. I'll put it in my next batch of enhancements.
Thanks guys.
Rik

rdeboer’s picture

Status: Needs work » Fixed

Available in snapshots dated 10-Nov-09 or later.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

carvalhar’s picture

hi,

i'm using Domain Access and Workflow, and i'm having problems with different workflow states for different domains. Eg.: in my case, each domain can have its own state defined, so i copied 2 tables in DA: workflow_node and workflow_node_history.

These tables are getting updated normally, when i check at the database, sid values are right. But when i try to view as anonymous user that node in one domain checked to invisible status, it is actually visible, because the status, independently of the domain is always the last one modified.

I tried to hard code the function workflow_node_current_state($node) to get the the sid from DA doubled table, but even so it's getting the last modified state.

How can i configure to be able to have two grants:
1 - the DA permission to see the node at one domain
2 - the role permission to see a workflow state

Thanks,
Carlos

carvalhar’s picture

Status: Closed (fixed) » Active

Activating

dkruglyak’s picture

What version of Workflow are you using and is there a specific module that implements its integration with Domain?

If not, you should take a look at how these integrations are done, perhaps on the example of Google Analytics.

carvalhar’s picture

hi,

i'm using workflow 6.x-1.3 and it has a sub module called workflow access.
where can i look these integrations?

can you send me examples?

thanks,
Carlos

dkruglyak’s picture

rdeboer’s picture

Status: Active » Closed (fixed)

This issue was closed at #10.
Subsequent comments seem to refer to the Workflow module etc. rather than Module Grants.
If necessary please post again in the appropriate forum.