Early Bird Registration for DrupalCon Portland 2024 is open! Register by 23:59 PST on 31 March 2024, to get $100 off your ticket.
When a user with 'administer nodes' but not 'administer menus' edits (and saves) a node that is in an OG Menu, the menu association is lost for the node.
This is happening (at least partially) because this call to og_is_group_member() in og_menu_access() returns true if the user has 'administer nodes' permissions:
if ($node && og_is_group_member($node)) {
return TRUE;
}
I think we probably want to pass FALSE into og_is_group_member() as the second parameter here to avoid this problem.
Comment | File | Size | Author |
---|---|---|---|
#1 | og-menu-administer-nodes-1031716-2.patch | 1002 bytes | marcp |
Comments
Comment #1
marcp CreditAttribution: marcp commentedThe attached patch sends in FALSE as the 2nd parameter to og_is_group_member() in the two places its called in og_menu_access().
This also fixes a bug where users with 'administer nodes' but not 'administer menu' can visit node/%node/og_menu/%menu (and everything under there) even though they are unable to visit node/%node/og_menu.
Comment #2
marcp CreditAttribution: marcp commentedNote that this patch is against HEAD, though I'm wondering about this: #1031886: HEAD or DRUPAL-6--2?.
Comment #3
jide CreditAttribution: jide commented@marcp : Thanks for the patch, I'll try this soon, and have a look at the mess with HEAD.
Comment #4
jvieille CreditAttribution: jvieille commentedThis patch does not seem to work.
When I apply it (manually) to the last dev, the menu options are showing up on nodes, but the menu fields are grayed. When editing a node attached to a menu link, it is ticked for deletion.
So, same problem, bu even more obvious
Comment #5
pfrenssenClosing, since the Drupal 6 version of OG Menu is no longer supported. If this issue is still relevant for the currently supported versions (D7 and D8) then feel free to update the version and reopen the issue.