My permissions are set so that Anonymous Users can only view node content and Global Organic Group Non-Members can only subscribe to a group. As an Anonymous User, I was able to create group content but not a group itself.

I created two groups. One had the Group Register setting set as "Show on registration page" and the other was set as "Do not show on registration page." The one set to show on the registration page was the Group the Anonymous User could create content for. When I changed the second Group to match the first, it showed up as an available Groups audience for content.

It's my assumption that an anonymous user would not see any options for creating content and would not be able to add Group content as a non-member. Am I possibly missing a setting regarding the registration page or is this a bug?

CommentFileSizeAuthor
#6 ogbetatest1.sql_.zip186.03 KBweekbeforenext
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

amitaibu’s picture

Does it happen on a clean installation?

weekbeforenext’s picture

I completely uninstalled 1.4 and then installed 2.0-beta1. I had issues migrating and upgrading to the new version. The site I'm working on is pretty fresh. Let me know if you need me to test in a completely new Drupal install.

amitaibu’s picture

> Let me know if you need me to test in a completely new Drupal install.

Yes please, always before reporting a bug you should check.

weekbeforenext’s picture

Okay. I installed on a brand new Drupal and I see the same issue. If a group is set to show on registration page in the group register field, an anonymous user can create content for the group.

amitaibu’s picture

> Okay. I installed on a brand new Drupal and I see the same issue.

Can you please attach a db dump, with everything not related to OG disabled, with default theme -- so I can test it locally.

weekbeforenext’s picture

FileSize
186.03 KB

Attached is a db dump.

amitaibu’s picture

Status: Active » Fixed

Committed a fix, thanks for the report + db!

micheljohn’s picture

could anybody explain , how to install ?

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

jacobpov’s picture

I can't seem to get it working any fix ? anonymous can still post

mvlabat’s picture

Status: Closed (fixed) » Active

I still have the bug. There's no fix. I think there should be more work on it.

mvlabat’s picture

This task seems refering to our problem:
#1906750: Create Group Content without beeing in a Group

Frank Ralf’s picture

I have the same issue. Granting the OG permission "Edit own article content" makes anonymous users being able to edit any content.

SeanT’s picture

I'm experiencing the same issue. It seems to be coming from og_node_access, specifically these lines

if (entityreference_get_selection_handler($field, $instance)->getReferencableEntities(NULL, 'CONTAINS', 1)) {
  return NODE_ACCESS_ALLOW;
}
SeanT’s picture

This patch fixes it for me https://drupal.org/node/1910874

drupal3013’s picture

Issue summary: View changes

I'm having the same problem but for drupal 6 not 7

fadgadget’s picture

same problem for me. anonymous users being able to post in a group which was set up to only let members and other site members (group non members) to post.

shushu’s picture

Status: Active » Postponed (maintainer needs more info)

Can you describe a clear scenario on 7.x-2.x in which anonymous and non-member can create group content without permission ?

brad.bulger’s picture

group node A and B have the same content type and each have custom OG permissions. user J is a member of both groups. J has "administer group" privilege on group A but not on group B.

if you create a group audience field that is able to use values from A & B's content type, then J will have create access on any content type that uses that group audience field.

that doesn't seem quite right to me.

brad.bulger’s picture

Status: Postponed (maintainer needs more info) » Active

  • amitaibu committed 09e3422 on 8.x-1.x
    Issue #1678202 reported by weekbeforenext: Fixed noce create permissions...