Enforce node access restrictions on Activity stream entires [#1797462]

You can't actually make an anonymous/authenticated home page without people being able to view (public) content. :)

Comment	File	Size	Author
#6	20121023-msrmbtidgdrs6usqme3cat67gb.jpeg	126.59 KB	ezra-g
#2	commons-anon.png	147.53 KB	webchick

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

webchick

she/they

English

Vancouver 🇨🇦

CreditAttribution: webchick commented 28 September 2012 at 05:18

Also, I am probably not going to be able to work on this, because I am not sure where said permission assignments would go. I'm used to doing them in $distro . '_install()'; but that doesn't seem to be the proper place in Commons.

Comment #2

webchick

she/they

English

Vancouver 🇨🇦

CreditAttribution: webchick commented 14 October 2012 at 22:47

Title:

Turn on "view published content" permissions for anonymous && authenticated users

» Anonymous users see 403 everywhere, but can still see titles of things

File	Size
commons-anon.png	147.53 KB

Yeah, these permissions are still funny. Here's what the logged out user sees on the home page:

Titles showing of activity stream, pages but no content available.

This is un-good, because if I'm truly not meant to see those things I should not see them in the interface. A title of one of those activity stream things might be "Acquia to acquire Microsoft later this month. Keep confidential." (I kid, I kid... but seriously. ;))

All of these things look like they need to be run through X_access(), and since I can't associate pages with a group, it seems like at least those should be public because otherwise I can't view the "how to register" page or whatever.

Comment #3

ezra-g CreditAttribution: ezra-g commented 15 October 2012 at 16:51

Title:	Anonymous users see 403 everywhere, but can still see titles of things	» Enforce node access restrictions on Activity stream entires
Component:	Code	» Activity/status streams

Re-titled with the action item to fix this.

I see a few ways of handling this:

A) Since Commons defaults to having only public groups, we can not write activity stream messages about unpublished nodes, and unpublish messages when nodes are unpublished.

B) Implement proper node access on activity stream entires. This is the most robust solution but comes at the potential performance cost of additional node access checking.

Comment #4

ezra-g CreditAttribution: ezra-g commented 15 October 2012 at 16:52

I created #1813398: Turn on "view published content" permissions for anonymous && authenticated users as a separate issue.

Comment #5

meba CreditAttribution: meba commented 18 October 2012 at 13:12

I think B is the right choice since you never know where content bubbles up. Messages are entities so content access on them shouldn't be hard. We could also implement the D7 hook that allows us to check access for anonymous users without an expensive query?

Comment #6

ezra-g CreditAttribution: ezra-g commented 23 October 2012 at 12:41

File	Size
20121023-msrmbtidgdrs6usqme3cat67gb.jpeg	126.59 KB

I chatted with amitaibu and he suggested that this might be simple to add to Message views, per the attached screenshot. We should do some testing :).