I'm trying to chase down the cause of this bug but it looks like users who "request" membership from an organic group are being assigned the "default" role before they are actually approved as members. Ill post any progress here but i thought it might be useful if anyone had a similar experience or if this was a user error.
Reproduce Steps:
1. In OGUR designate a default role for your groups that allows users with it to "edit" your group content type.
2. Create a group that is "moderated" and requires group admin approval to join.
3. Request as a regular user to join the created group from the /og page.
4. Do not yet approve the request as the admin but instead navigate to that groups home page as the requesting user and youll see an edit tab as you would expect if you had been approved.
Expected outcome: no edit tab (or more accurately the role shouldnt be assigned yet unit the approval comes in).
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | 837134_og_user_roles_default_role_given.patch | 977 bytes | hefox |
| #1 | 837134_og_user_roles_default_role_given.patch | 977 bytes | hefox |
Comments
Comment #1
hefox commentedFor future reference, security issues should be reported as such (and wrong access seems like a security issue); talked it over with someone and they said since it's been publicly posted here for so long it's fine to keep it here.
Patch not heavily tested.
Comment #2
hefox commentednid => gid