Visibility Access issue and Domain Access

subscribe - Have the same problem.

I don't use domain access, so I won't work on this.

I have this problem with Ubercart - with Ogranic Groups enabled, anonymous users can no longer access the ubercart catalog view uc_catalog - I had to uninstall OG 7 to make it work again. This seems to have to do with OG's node access or content access restrictions, but mucking about with those permissions within the OG permissions interface changed nothing...

It too me 5 hours to track this down... I am not a coder at all and cannot figure where or how to change this.

Since this issue has been traced to OG and it obviously affects the way content is accessed in potentially many other modules I have escalated this from "normal" to "major"

subscribe

For D6, it is impossible to use Domain Access together with OG, because both applications rewrite node access rules. So, the rewrite is actual of the last enabled application, and conflicts with previously enabled.

I think the same is for D7.

I've run into this as well. It seems to come down to conflicting node grants provided by OG and DM. Domain access adds a very liberal 'view all nodes' node grant to the node_access table. It adds the grant in the function domain_set_default_grant() in domain.module:

/**
 * Ensure that the 'domain_all' grant is present.
 */
function domain_set_default_grant() {
  static $check = NULL;
  if (is_null($check)) {
    $check = (bool) db_query_range("SELECT 1 FROM {node_access} WHERE realm = :realm AND gid = :gid", 0, 1,
      array(
        ':realm' => 'domain_all',
        ':gid' => 0,
      )
    )->fetchField();
    if (empty($check)) {
      db_insert('node_access')
        ->fields(array(
            'nid' => 0,
            'gid' => 0,
            'realm' => 'domain_all',
            'grant_view' => 1,
            'grant_update' => 0,
            'grant_delete' => 0,
        ))
        ->execute();
    }
  }
}

As I understand it, this node grant effectively removes any access checks for viewing any nodes on your site. So even though OG private nodes insert a node grant to conditionally grant view access to a node based on group membership, because of the way node grants work it doesn't matter since DM grants view access to all nodes.

I'd love to get feedback from the author of DM to verify this is the case. I have had limited exposure to node grants, but am fairly confident that's how it works.

To summarize, if you want to restrict view access to some nodes (eg. OG private nodes), you can't use domain access.

Matt

Found this issue: #634932: OG Directory does not show all groups as it should, which is basically the same thing. DM author describes the issue well in comment #2.

Subscribing

It would be useful with a statement about the compatibility related to having more than one module that rewrites node access rules, and a list (table) of which modules currently does this, and if some or all of them are in conflict with each other.

That should ideally be a handbook page which the Readme.txt file AND the project page can link to with a short description.

+ for #10

Whom should we ask for that?

I've tested access modules since D5 and I can't remember two that worked together unless they're part of a bundle. The answer has always been: patch or quit. I can remember at least those ones, each incompatible with all the others:

- Organic groups (example: #1268068: Add option to always grant view access to users belonging to content's group audience)

- Domain access (example: #243731: Making TAC and OG Work Together)

- Workflow (example: #185641: workflow_access vs. taxonomy_access or #171882: Incompatibility between workflow_access and Taxonomy access control? or #207358: Organic Groups and Workflow Access visibility)

- TAC (example: #1046128: OG and TAC working on latest versions? or #1036232: Compatibility with Organic Groups public/private posting.)

- Content Access (example: #1306846: Not working, no content blocked or #764904: Content Access tool conflicts with Domain Access)

You'll find issues like this everywhere, all similar and generally tagged as Fixed or Won't fix or Support Request. You just won't find any solution besides patching away Drupal code...

Discussions generally regard the incompatibility of two contributed modules: I remember very few occasions of effort across different modules and core developers (like #286692: Improve Node Access system).