og_node_create_links() should respect group context when checking permissions [#1671122]

It seems like the function og_node_create_links() should be using og_user_access() to check permissions instead of just node_access(). The problem I'm seeing is that calling og_node_create_links() to display links in a block and then displaying the block on a group page. Ideally the links will only contain the content types that the user has permission to create in the context of the group currently being viewed.

I've attached a patch that fixes this for my use case however I'm not entirely sure what other ramifications it might have.

Comment	File	Size	Author
#3	og-node-create-links.patch	566 bytes	Jax
#3
#2	og-create_links_permissions.patch	1003 bytes	Jax
#2
	og-create_links_permissions.patch	1003 bytes	eojthebrave

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

amitaibu

Hebrew

Israel

CreditAttribution: amitaibu commented 4 July 2012 at 17:38

Status:

Needs review

» Needs work

+++ b/og.moduleundefined
@@ -3054,7 +3054,9 @@ function og_node_create_links($group_type, $gid, $field_name, $destination = NUL
+    $perm = t('Create %type_name content', array('%type_name' => $info->name));

The perm name should be og_user_access($group_type, $gid, "create $node_type content")

+ How about a small test ? :)