This questions is semi related to #1539928: Panels IPE allows users without node edit permissions to use 'Customize this page' and 'Change this layout' and maybe it's more of an OG module question than a panels/panelizer question, but here goes:

On a site that uses OG and panels to control OG homepage layouts, is it in theory possible to have granular per-group permissions for OG node layouts, content etc?

For instance right now if a user has the global panelizer permission to edit panelized node layouts, they can rearrange the blocks etc. for groups they aren't members of.

In an ideal scenario, all site users of a certain role could be granted the global permissions to create and administer organic groups and also to edit panelizer layouts, but at a group level, through the group permissions configuration, users could only edit the layouts of group nodes of which that user is an owner or administrator of.

It seems to me based on my initial experiments with the Open Academy (http://drupal.org/project/openacademy) project that this might be possible?

Comments

merlinofchaos’s picture

Status: Active » Fixed

As of the latest -dev, Panelizer now requires you to have permission to edit the underlying entity in order for IPE to function. Is that sufficient?

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

StephenOTT’s picture

Could each of the Permissions that are available as part of People>Permissions>Panelizer be available as part of OG permissions?

merlinofchaos’s picture

I don't know that there would be a way to do that, unfortunately.

heyyo’s picture

I also need this functionnality, I found a sanbox which has been made for this purpose:
https://drupal.org/node/1596390

But this project doesn't seem ready yet.

Any other progress on this issue ?

guillaumev’s picture

I also have the same problem, with the following use case: for each group, I have managers and editors. Managers are supposed to be able to administer the group and use panelizer, but I don't want editors to be able to use panelizer (ie editors should only be able to edit the content within a group, NOT the layout)...

guillaumev’s picture

Version: 7.x-3.0-rc1 » 7.x-3.x-dev
Issue summary: View changes
Status: Closed (fixed) » Needs review
StatusFileSize
new2.48 KB

Hi,

Given that I needed this functionality, I'm providing an initial patch which should work with group content (ie it will allow you to set panelizer permissions within a group for the group content only).

guillaumev’s picture

StatusFileSize
new3.53 KB

Here is an updated patch which also provides OG permissions to panelize the group node.

heyyo’s picture

The patch provided in #8 works great for me, but to make it work I need to also give Panelizer permissions to logged-in users in Drupal Permissions (admin/people/permissions).
For example "Administer Panelizer layout" + "Administer Panelizer content". And only after I have access to Panelizer settings with an admin OG.

damienmckenna’s picture

StatusFileSize
new3.76 KB

Rerolled, plus fixed a few minor things with whitespace.

damienmckenna’s picture

Status: Needs review » Fixed

Committed.

  • Commit ec3331f on 7.x-3.x by DamienMcKenna:
    Issue #1751426 by guillaumev, DamienMcKenna: Extra permissions for use...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

Helrunar’s picture

StatusFileSize
new115.17 KB
new143.02 KB
new109.36 KB

I've got the same issue with the latest dev-Version of Panelizer from 2015-Jan-19 and i can see all the new permissions. I have unchecked all Permission, so the Role should not be able to administer Panelizer on the organic group, but it not working. The Editor-Role are able to administer Panelizer for OG without any permissions set.

Helrunar’s picture

Status: Closed (fixed) » Active
damienmckenna’s picture

Status: Active » Closed (duplicate)

EclipseGc added a patch (#2435003: Allow contrib to collaborate with panelizer access) to allow other modules to change the permissions, so this need will be rolled into a separate module.