I am using some other Node Access module for fine-tuning ticket visibility. For example, using Taxonomy Access Control users can set a tag at ticket-creation time to limit visibility to a set of users, and so on..

But, Support module's own "Access Client-name tickets" permission setting overrides any other visibility restrictions, and grants view permissions anyway. It should be implemented the other way around: deny if this permission is unset, don't deny (or do nothing, leave it to node-permissions to handle) visibility.

Thanks for the AWESOME module!

Comments

sly5’s picture

sly5 commented

Sorry for the fragment: I meant to conclude:

".. don't grant visibility otherwise [if the view permission is on]. "

sly5’s picture

sly5 commented

I just found one work around, although it might not be the most correct fix:

There is only a single line to change: 

function support_access($op, $node, $account) {
// ...
// ... by the end of this function 
else {
   return support_access_clients($client, $account) ? NULL : FALSE;
}
sly5’s picture

sly5 commented

bump

jeremy’s picture

jeremy commented
Version: 6.x-1.x-dev » 7.x-1.x-dev
Priority: Critical » Major
Status: Active » Patch (to be ported)

Cleaned up hook_access() and improved support module to respect other Drupal access control modules:
http://drupalcode.org/project/support.git/commit/fd7ce22

Needs to be ported to the 7.x branch.

izmeez’s picture

izmeez commented

The way this works with organic groups 6.x-2.x is great. Thanks.

izmeez’s picture

izmeez commented
Status: Patch (to be ported) » Needs work

On testing this further with organic groups it works when users are accessing the support ticket node(s). Users cannot access nodes within the group unless they also have support ticket "client" access.

It also works with Drupal search.

However, it does not restrict the user from seeing the teasers or titles of tickets in views such as recent posts.

I have changed the status to needs work rather than opening a new ticket.

Thanks.

izmeez’s picture

izmeez commented

I'm again wondering if the ideas used in the views_unpublished module may be helpful to those with the coding expertise, http://drupal.org/node/768354

Does the order of access control modules make a difference?

bdragon’s picture

bdragon commented
Status: Needs work » Fixed

@#6: Please see #818250: Support ticket comments displayed in the 'Recent comments' block even when user don't have permissions, I think...
-------

Ported to 7.x-1.x.
http://drupalcode.org/project/support.git/commit/4178c19e3c8b917b07d972c...

izmeez’s picture

izmeez commented
Status: Fixed » Needs work

@bdragon re: comment #8 the link to the issue with recent comments may be a similar problem and may help in finding a solution but this problem with the titles and teasers showing in views is a problem. Yes, a work around is to change the view(s) and exclude tickets but is there a better solution? I've put this back to "needs work".

bdragon’s picture

bdragon commented
Status: Needs work » Postponed (maintainer needs more info)

I just rewrote the query altering and fixed an issue where people with create ticket permission were not getting filtered down to their clients properly.

I will be releasing beta1 shortly, would appreciate feedback on whether or not it helps.

izmeez’s picture

izmeez commented

Looking at the commit log it looks as though this is committed to the 6.x-1.x-dev branch so I will give it a test.

izmeez’s picture

izmeez commented
Status: Postponed (maintainer needs more info) » Reviewed & tested by the community

@bdragon, Yes this seems to have fixed it for support-6.x-1.x-dev. I haven't had a chance to do extensive testing but views including titles and teasers now seems to respect the access grants for og.

jeremy’s picture

jeremy commented
Status: Reviewed & tested by the community » Fixed

Great news! Marking as fixed.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

ramirez.gerardo’s picture

ramirez.gerardo commented
Category: bug » task
Status: Closed (fixed) » Needs review

All,

I've created a D7 module to help the co-existance between Organic Group and the Support modules. Basically the module now allows for members of the same group to view each others support tickets. I'm new to community contributions so I was only able to create a sandbox version... Please download and test the module here:

http://drupal.org/sandbox/ramirez.gerardo/1741272

jeremy’s picture

jeremy commented
Status: Needs review » Closed (fixed)

Please open a new ticket to track this; it's not helpful to tack it onto a closed, previously fixed ticket.