URL parameters are not taken into account if there is no field access [#1299174]

URL parameters like gids_node=id are not taken into account if the user lacks access to the field. This is odd if you just want to hide the field from the user but provide some links that put content in the right group.

Attached patch fixes that by implementing a default-value function that takes the og-context from URL into account - as the UI. Using this function ensures that the field API stores the correct value regardless whether the form widget is actually shown.

Comment	File	Size	Author
#8	og_field_defaults.patch	1.84 KB	fago
#8
#7	og_field_defaults.patch	1.8 KB	fago
#7
#3	og_field_defaults.patch	1.78 KB	fago
#3
	og_field_defaults.patch	1.77 KB	fago

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

amitaibu

Hebrew

Israel

CreditAttribution: amitaibu commented 4 October 2011 at 18:07

Cool, didn't known about this callback. The function should check for the user's access to the groups in the URL, to prevent from submitting it to inaccessible groups. Also, we also need to take care of existing groups. (the widget currently has element validate callback that re-adds those groups)

Comment #2

amitaibu

Hebrew

Israel

CreditAttribution: amitaibu commented 4 October 2011 at 18:16

Maybe we can move the whole logic from og_field_widget_form() dealing with the default value over to that function.

Comment #3

fago

German

Vienna

CreditAttribution: fago commented 15 November 2011 at 15:21

File	Size
og_field_defaults.patch	1.78 KB

I've re-rolled the patch and added the access check to groups in the URL.

>Also, we also need to take care of existing groups. (the widget currently has element validate callback that re-adds those groups)

The function is only taken into account if the entity is created. Else the field API takes the values out of $entity, so the function is not called. Consequently, we cannot move the whole value handling over to it.

Comment #4

amitaibu

Hebrew

Israel

CreditAttribution: amitaibu commented 15 November 2011 at 18:29

Status:

Needs review

» Needs work

Patch looks good.

+++ b/og.field.incundefined
@@ -392,6 +392,25 @@ function og_field_widget_element_validate($element, &$form_state) {
+    $group = og_load($gid);

Maybe better to use og_load_multiple()

A small test would be much appreciated :) (If you don't have time, I'll do it).

Comment #5

fago

German

Vienna

CreditAttribution: fago commented 16 November 2011 at 09:18

Status:

Needs work

» Needs review

>Maybe better to use og_load_multiple()
Oops. Done so.

>A small test would be much appreciated :) (If you don't have time, I'll do it).
Makes sense, though tests require setting up field access first. Do you have already tests for that? I guess I'll better leave it up to the og master.. ;)