I upgraded a site from D6 using the instructions for the Migrate, and it appears that the thousands of posts in my private groups are now public, and visible to anonymous users. I added the Group Visibility field to the private groups, and set it to private. Visiting the group page now says that it's private, but all the posts in those groups are still public and visible.

I added the Group Content Visibility field to the group content type, and set it to private for one post, which did make that post private, but do I have to do this for each of the thousands of private group posts? Shouldn't setting the Group Visibility to private make all the posts in that group private, too?

I've searched the issue queue and found a number of issues relating to visibility, but none of them that I could find addressed this question.

Comments

I'm making progress, but still have a problem. It looks like the nodes are now respecting the privacy of the group. I'm embarrassed to say that I think at least part of my problem was a caching problem; I think I fixed it a while back, but didn't see the change because of the cache. As far as I can tell, it looks like as long as the content type has the "Group Content Visibility" field added to it, you don't have to actually set the value of the field for each piece of content; it looks like it defaults to the value of the group.

However, the problem I'm having now is that the comments are still visible. In other words, if I use an anonymous user to go to a forum topic node which is posted in a group, I can't see the content of the node itself, but I can see all the comment replies. I tried adding the "Group content visibility" field to the "Forum topic comment" bundle, but I get the error "Field Group content visibility can only be attached to Node entity bundles." Is there an equivalent for comments, or some other way that I can make comments respect the visibility setting of the group?

If I edit a node that's in a private group, and actually set the "Group content visibility" to "Group Default," then an anonymous user gets the "Access Denied" message that I expected to get, and neither the node nor the comments are visible to an anonymous user. If I don't edit the node to change the "Group content visibility" and leave it unset, the node content is hidden to an anonymous user, but the comments on that node are not.

Category:support» bug

I've done some more experimenting, and I think there actually is a bug in the visibility settings, so I changed the Category on this issue. Here's what I found by changing the values in one browser and looking at the page as a logged out user in a different browser. Caching is turned off.

1. Group Visibility: Public
Group Content Visibility on member node: Use group defaults
Node content does not display, but comments on the node do display

2. Group Visibility: Public
Group Content Visibility on member node: Not set
Node content does not display, but comments on the node do display

3. Group Visibility: Public
Group Content Visibility on member node: Public
Node content does not display, but comments on the node do display

4. Group Visibility: Public
Group Content Visibility on member node: Private
Access Denied (Functions as expected)

5. Group Visibility: Private
Group Content Visibility on member node: Use group defaults
Access Denied (Functions as expected)

6. Group Visibility: Private
Group Content Visibility on member node: Not set
Node content does not display, but comments on the node do display

7. Group Visibility: Private
Group Content Visibility on member node: Public
Node content does not display, but comments on the node do display

8. Group Visibility: Private
Group Content Visibility on member node: Private
Access Denied (Functions as expected)

9. Node not a member of a group:
Full node content and comments display (functions as expected)

For 1, 2, 3, and 7 I would expect both the node and the comments to display, but the node is not displaying, just the comments.

For 6, it seems to me that both the node and the comments should be hidden.

Version:7.x-2.2» 7.x-2.x-dev
Status:Active» Needs review

Does this still happen if you upgrade directly to the recent 2.3 release?
Ref. the following issue which was fixed prior to 2.3, and could possibly be related:
#2061579: Non-members see private group content.

It is very practical for many people to know if these kinds of scary bugs are still a problem, especially for upgrades, so please report back with the results.

Priority:Major» Normal
Status:Needs review» Active