Problem/Motivation
With the default Group permissions - that does not allow non-group members to access information about a Group, in other words, without granting "View published group" to outsiders - invited users cannot see/access the name of the Group that they were invited.
(Please see the attached screenshot.)
Steps to reproduce
Proposed resolution
Well, this could be a tricky one, but what we did on a downstream project (and probably that could be also implemented in this module) is:
1. We override the entity access handler of Group because it uses the default one that does not differentiate "view" vs. "view label" operation. See: https://github.com/drupal/core/blob/9.4.x/lib/Drupal/Core/Entity/EntityA...
2. In that custom access control handler - but after "view" and "view label" is considered a different operation this could be even implemented in a hook_ENTITY_TYPE_access() for group entity type - we added a small glue code that grants "view label" access to a user if it has a pending invitation to a group.
3. ...and FTR, we also had to patch Drupal core's EntityReferenceLabelFormatter because after that it incorrectly started to render links instead of plain text Group titles: See https://www.drupal.org/project/drupal/issues/3293287.
Remaining tasks
User interface changes
API changes
Data model changes
| Comment | File | Size | Author |
|---|---|---|---|
| ginvite_bug1.png | 23.22 KB | mxr576 |
Comments
Comment #2
mxr576Comment #3
mxr576Comment #4
lobsterr commentedI think, it is ok to allow users to view a group, if we have invitation to it.
Comment #8
lobsterr commentedComment #9
mxr576Since there is no tagged stable release with these changes, let me discuss it publicly here: I wonder if not bubbling up cacheability information from those invites that granted view/view label access to group could lead to information disclosure vulnerability when an invitation is deleted/revoked.
Comment #10
lobsterr commentedok, I will handle this case in a separate ticket
Comment #11
mxr576and that ticket is #3391591: Add cache tags for invitations, when we allow to see a group