Ask question needs create FAQ permission

This is a regression from the stable version. I just upgraded to mitigate a serious security hole. It seems that there's another one now :(

ping

What was the regression? AFAIK, this is the way it has always worked. Security patches are coming out soon.

Perhaps I'm mistaken, but as I recall, I had my site set up so anonymous users could *ask* a question without creating a FAQ. Or perhaps they did create the FAQ but couldn't answer it at the same time?

This module has always created an unpublished FAQ node. Asking and answering are controlled by the permissions.

hmm. Yes, I see now. If you follow the Ask link, part of the form is hidden. But if you click on the Create>Faq link, you get the whole form. It also shows up in the menu, even if Create Content is normally hidden to anons.

At the very least, this is very confusing to a newb. Do you have any ideas on how to make this better?

Yes, the asker should not see the answer field because it hasn't been answered yet.

My first suggestion is that you try the current 6.x-2.x-dev version. I am going to be out of touch for several days at least.

subscribe

ideas how to make this better: Make the "ask question" a separate item in hook_menu, with a separate page callback and separate access control. The callback can then simply clone and modify the original faq node creation form.

You can even do that in a custom module, if you don't want to wait for a new faq_ask version.

The bugs here are:

a. Users with "ask a question" but not "answer a question" can nonetheless both ask and answer questions (by following the link node/add/faq).

b. Users with "answer a question" but not "ask a question" permission can both ask and answer questions.

I think the expected behaviour is:

* A user with "ask a question" but not "answer a question", can submit questions but not answer either own or others' questions.
* A user with "answer a question" but not "ask a question" permission cannot either create or edit a question but can answer others' questions.

A basic problem is that Drupal's permission system is additive. One permission should not cancel out another permission that a given role has. Assigning "answer questions" to a user should not take away "create faq" from that user.

Proposed approach:

* Eliminate "answer question" permission. Instead, use "edit faq" to test for the ability to edit (answer) others' questions.
* Drop the ask=true path argument.
* Eliminate "ask question" permission. Instead introduce "answer own questions" permission. Users without this permission don't get the body field.

Here we go, a patch.

Effects:
- the form now appears in the url path "faq_ask", no more redirects.
- faq_ask needs "ask question" permission, no "create faq" or "create node" required.
- undesired fields and fieldsets are stripped from the faq_ask form, even for the admin.
- on any faq related form, users need "answer question" permission to see all fields.
- users with "ask faq" and "edit own faq" permission can edit their questions, but the rest of the edit form is stripped, unless they have permission to "answer questions".

Still missing:
- Prevent people with "edit own faq" permission from editing a question after it has been answered. The "answerer" could do that by changing the author, but it would be more elegant to have a dedicated mechanic for that.

Proposed approach:

* Eliminate "answer question" permission. Instead, use "edit faq" to test for the ability to edit (answer) others' questions.
* Drop the ask=true path argument.
* Eliminate "ask question" permission. Instead introduce "answer own questions" permission. Users without this permission don't get the body field.

My patch goes a different way, but maybe your proposal is not so bad after all.
With my patch, the "create faq" permission doesn't make much of a difference, except that you can't visit node/add/faq. If you have "create faq" permission, but not "answer question", then node/add/faq will look the same as faq_ask, so, not a big difference.

Maybe the "create faq" should allow to create complete faq nodes, and the only thing where you need "answer question" would be if you want to edit the "body" field of someone else's question..

I see that your patch "faq_ask.module.patch.txt" has already been applied to the "faq_ask-6.x-2.0.tar.gz" module. It looks like you fixed a lot but my authenticated user with only "view fax page" and "ask question" permissions is not getting to the "Ask a Question" page. They are being sent to my front page which is being generated by the module "Custom error" on the 403 error setup. My other roles have more permissions and they work correctly. Problem is the authenticated user is the only one that will be asking questions and I don't want to give them the ability to create or edit FAQ's. Please let me know when a solution is found.

Thanks

subscribe

Subscribe -- same problem -- anonymous users still can't use it unless I grant them access to create faq which give public access

@mudbone:
Two points.
1. The latest release is from October 09. That was before I posted the patch.
2. A closer look reveals a serious problem with my patch: It goes in the wrong direction! Every "-" should be a "+", and vice versa.

So, here is a new patch, hopefully it's better.

Patch works. I can now post a question as anonymous user. Yeah! Thanks!

Q: After posting Q as anonymous user, should I see an access denied message?

It appears that after posting the question it takes me to the node that was just created. However, the anon user doesn't have access to it by design. The node is unpublished so they can't see it -- again by design.

Is there somewhere else that they should be directed so it is less confusing? Or may be there's some config option that resolves this??

I'm not sure.. the thing is, this is your own content, so probably there is an exception that allows the author to see this unpublished node. Which makes sense!

Can you log in as a different user and try again?

Of course it also depends on other node access modules installed, that allow to set "view all", "view own", "edit all" and "edit own" permissions per content type.

EDIT:
I did not take enough time to read your post.
Your point was, the anonymous user can NOT see the node, so he should be redirected somewhere else. Totally true.
Any ideas?
What should this "thank you" page say? Should it repeat the question, or should it be just a static page? Who should be able to see it, and for how long? Or should it be a one-time page, where you can never return? If it is just a static page, would it make sense to make it a regular node?

Or can we do something with $_SESSION, that would allow the anonymous user to see a node he created himself? Or does Drupal already do that?

Another question, what should happen in the "just installed" case, when a new module has no permissions set up yet, and the "ask a question" block is enabled and an anonymous user hits the page?

My vote is to have it not display anything, rather than redirect to the node/add page - the wsod is not fun to debug.

subscribe

We do have a patch, so this should be "needs review".

subscribe

I had the FAQ_Ask block active for anon users on the same page as the /faq page. After 'upgrading' to the latest version of FAQ_Ask, the /faq page was no longer accessible to all users (even UID=1), going to /faq redirected all users to the ask a FAQ page.

I disabled the ask-a-faq page and all is good (other than people not being able to ask FAQs...) - I posted my issue here but was told it was related to this issue.

The version referenced on this issue is 2.0-alpha1 but I assume it is about the latest version 2.0 given the dates of the comments. Assuming I am right, this is what we are experiencing. Can anyone provide some assistance?

Two of us created the patched module file per the +/- instructions. Both times we locked up the site - got a 500 access issue error. For us, when we tried to implement the "ask a question" block, the site started looping. It put the site into a node/add/faq look. We ended up reloading a previous version of the database to regain access to the site.

thanks
c

Yes, it's 6.x-2.0
The patch worked for me, thanks.

David

David, would you mind uploading your patched module file? We have applied patches many times in the past on other modules without issue so it doesnt make sense that we are having problems implementing this patch. We wonder if there is something else going on but it is hard to tell until we know it isnt just us. If we use your patched module file (which has been shown to work) and the site still locks up then we know to look at other parts of the site to find the problem.

thanks
c

I simply took the available version, and applied the above patch. The result is here.

thanks for the patched file!

ok, we uploaded the module you attached. We got past sudden http 500 screen of death - that is the good news. However, we are back to our original problem. When we tried to enable the "ask a question" block, the site locked up and we got the http 500 screen of death.

We went into the database and set the block status to zero so we are okay. Any idea what causes the block issue? watchdog said:

message = node/add/faq
type = access denied
variables = N;
severtiy = 4
location = http://mysitename.com/node/add/faq?ask=true

but now watchdog says this (over and over and over):

message = Parsed JavaScript file %file.
type = locale
variables = a:1:{s:5:"%file";s:17:"misc/tabledrag.js";}
severtiy = 5
location = http://mysitename.com/faq_ask

thoughts? is there an issue with locale and faq_as

You can find the 'Ask a question' block issue here: #620640: Enabling the ask-a-question block takes over all pages on the site

On my side an error for missing function (faq_ask_block_content() ) display. So I change this line(906) like it was before.

          // Ask a question block.
          if (user_access('ask question')) {
            $block['content'] = faq_ask_page(NULL);// faq_ask_block_content();
          }

@donquixote Thanks for the patch! It worked like a charm.

Regarding the thank you page - how about setting up a page similar to the way webform does? That is, it gives you a text area and you can enter whatever thank you text you want or redirect to a node.

OK, so I went and completely deleted my old comment - here's my new solution that seems to work without issue.

I modified the faq_ask_form_faq_node_form_alter function and adding the following line at the end. I added my change below line 226 of the patch faq_ask.module.

  $form['#redirect'] = 'faq';

Short and simple. Redirects the user back to the FAQs page and displays the message thanking the user. If you want to set the redirect to somewhere else, just change the path being set.

So close and yet so far...
What about node_save($node);?

@kardave - check out my post at #33. That seems to work!

Oh, you deleted your post.
Nice trick, lol :)

I've created a new patch. This patch should contain everything from #17 in addition to my code from #33.

So, with this patch, you should be able to allow anonymous users to create questions and they will be redirected back to the FAQs page after question submission instead of the unpublished node.

This is the first patch I've made so let me know if it doesn't work and I'll try making it again.

subscribing

Hey! Good work!
I tried your patch and:

1. you have created the patch from a local copy of the original faq_ask.module file so the patch wouldn't go through unless the name is changed in the patch file from faq_ask_orig.module to faq_ask.module
2. The patch does not seem to contain the faq_ask_block_content(); implementation - or is it a typo? maybe it should read faq_ask_page();

Testing the patch reveals the whole faq node form in the block (after replacing faq_ask_block_content() with faq_ask_page() ) and I had expected the Answer field to be removed there.

I have made a patch that implments the block form the way I had anticipated it to be. I have not implemented your good ideas on redirecting to the faq page for anonymous users and the other things though.

See #421818: Faq_Ask block redirects for the patch.

I have never did a patch and do not want to kill my site, so I'll wait untill it is working and an easy install, copy it to the mod folder and update the site. Hope something comes out soon, for now I'll just disable it.

Confused, I would like the latest working patch, but I can not patch as I do not have the software. If someone would send it to me that would be much appreciated.

Note that the patch does not correct this issue of having to enable create faq for users who should be able to ask a question, but my patch does correct the issue of the block locking the site. If you want a patched module with the working block and the added feature of notifying the asker when answered, i can upload one for you in the proper thread/issue.
I'm at the downhill slopes today, but I'll see what i can do tonight.

I do

subscribing

I have updated #198828: Notify Asker on answer with a patch and a patched module that should be working.

Hi Stenjo

Thanks for the patch and especially the patched module as I have still not figured out how to do that. It adds the notify asker perfectly, and the "subscribe to newsletter" is a neat addition. It does not seem to address the issue here though, which is not to have to give the asker any FAQ permissions other than to view the FAQ and Ask a Question. Is this right, or am I missing something?

On our site we use the FAQ module to create "site help" question pairs which only the admins should access (not even the experts). But the Ask an Expert functionality is a fantastic value-add which will be invaluable if we can get the permissions issue sorted.

Seems like the permission issue will have to wait until a rewrite of the module as this is linked directly to the Frequently Asked Question permissions at the moment and cannot be trapped by this module it seems.
Will probably need a different way of handling questions - maybe as a separate content type. Ideas are welcome.

I resolved this issue on my site with the "path_access" module.

I simply granted permission to anonymous to create faq. I then used "path_access" to decline when the "ask=TRUE" is not being used.

To do this, I used the "path_access" module. In path_access configuration, under anonymous user, I set the control to "access every page except the given pages" and entered "node/add/faq".

Thus "node/add/faq?ask=TRUE" is allowed but "node/add/faq" is given an access declined.

I say that is a good workaround. I'm happy at the moment - at least for version 2, but I'll consider finding a solution within the faq-ask module at a later stage.
Feel free to reopen this issue if you are unable to use the workaround.

Further note: this was disconcerting to me at first until I realized what was happening.

For some reason the path_access module still allows viewing of the full FAQ form (with answer) but it still prevents saving.

i.e. If someone clicks on "Ask the expert", sees "node/add/faq?ask=TRUE" in their browser, and edits the URL to say "node/add/faq", they will see the full FAQ form with answer. Should they complete the form with answer and TRY to save, path_access will then prevent saving of the FAQ (i.e. prevent the post to node/add/faq).

Only someone malicious would notice this behaviour since I don't link to node/add/faq from any anonymous-accessible pages, and my honest users wouldn't ever come across this.

So the solution is still acceptable.

I have followed the steps as indicated in #47, but am receiving the "Access denied. You are not authorized to access this page" for both node/add/faq and node/add/faq?ask=TRUE.

See http://drupal.org/node/432408#comment-4565328
for another way to fix this.