I'm trying to chase down the cause of this bug but it looks like users who "request" membership from an organic group are being assigned the "default" role before they are actually approved as members. Ill post any progress here but i thought it might be useful if anyone had a similar experience or if this was a user error.

Reproduce Steps:
1. In OGUR designate a default role for your groups that allows users with it to "edit" your group content type.
2. Create a group that is "moderated" and requires group admin approval to join.
3. Request as a regular user to join the created group from the /og page.
4. Do not yet approve the request as the admin but instead navigate to that groups home page as the requesting user and youll see an edit tab as you would expect if you had been approved.

Expected outcome: no edit tab (or more accurately the role shouldnt be assigned yet unit the approval comes in).

Comments

hefox’s picture

Priority: Normal » Major
Status: Active » Needs review
StatusFileSize
new977 bytes

For future reference, security issues should be reported as such (and wrong access seems like a security issue); talked it over with someone and they said since it's been publicly posted here for so long it's fine to keep it here.

Patch not heavily tested.

hefox’s picture

StatusFileSize
new977 bytes

nid => gid