I upgraded a site from D6 using the instructions for the Migrate, and it appears that the thousands of posts in my private groups are now public, and visible to anonymous users. I added the Group Visibility field to the private groups, and set it to private. Visiting the group page now says that it's private, but all the posts in those groups are still public and visible.

I added the Group Content Visibility field to the group content type, and set it to private for one post, which did make that post private, but do I have to do this for each of the thousands of private group posts? Shouldn't setting the Group Visibility to private make all the posts in that group private, too?

I've searched the issue queue and found a number of issues relating to visibility, but none of them that I could find addressed this question.

Comments

SheilaRuth’s picture

I'm making progress, but still have a problem. It looks like the nodes are now respecting the privacy of the group. I'm embarrassed to say that I think at least part of my problem was a caching problem; I think I fixed it a while back, but didn't see the change because of the cache. As far as I can tell, it looks like as long as the content type has the "Group Content Visibility" field added to it, you don't have to actually set the value of the field for each piece of content; it looks like it defaults to the value of the group.

However, the problem I'm having now is that the comments are still visible. In other words, if I use an anonymous user to go to a forum topic node which is posted in a group, I can't see the content of the node itself, but I can see all the comment replies. I tried adding the "Group content visibility" field to the "Forum topic comment" bundle, but I get the error "Field Group content visibility can only be attached to Node entity bundles." Is there an equivalent for comments, or some other way that I can make comments respect the visibility setting of the group?

SheilaRuth’s picture

If I edit a node that's in a private group, and actually set the "Group content visibility" to "Group Default," then an anonymous user gets the "Access Denied" message that I expected to get, and neither the node nor the comments are visible to an anonymous user. If I don't edit the node to change the "Group content visibility" and leave it unset, the node content is hidden to an anonymous user, but the comments on that node are not.

SheilaRuth’s picture

Category: support » bug

I've done some more experimenting, and I think there actually is a bug in the visibility settings, so I changed the Category on this issue. Here's what I found by changing the values in one browser and looking at the page as a logged out user in a different browser. Caching is turned off.

1. Group Visibility: Public
Group Content Visibility on member node: Use group defaults
Node content does not display, but comments on the node do display

2. Group Visibility: Public
Group Content Visibility on member node: Not set
Node content does not display, but comments on the node do display

3. Group Visibility: Public
Group Content Visibility on member node: Public
Node content does not display, but comments on the node do display

4. Group Visibility: Public
Group Content Visibility on member node: Private
Access Denied (Functions as expected)

5. Group Visibility: Private
Group Content Visibility on member node: Use group defaults
Access Denied (Functions as expected)

6. Group Visibility: Private
Group Content Visibility on member node: Not set
Node content does not display, but comments on the node do display

7. Group Visibility: Private
Group Content Visibility on member node: Public
Node content does not display, but comments on the node do display

8. Group Visibility: Private
Group Content Visibility on member node: Private
Access Denied (Functions as expected)

9. Node not a member of a group:
Full node content and comments display (functions as expected)

For 1, 2, 3, and 7 I would expect both the node and the comments to display, but the node is not displaying, just the comments.

For 6, it seems to me that both the node and the comments should be hidden.

Leeteq’s picture

Version: 7.x-2.2 » 7.x-2.x-dev
Status: Active » Needs review

Does this still happen if you upgrade directly to the recent 2.3 release?
Ref. the following issue which was fixed prior to 2.3, and could possibly be related:
#2061579: Non-members see private group content.

It is very practical for many people to know if these kinds of scary bugs are still a problem, especially for upgrades, so please report back with the results.

amitaibu’s picture

Priority: Major » Normal
Status: Needs review » Active
ajayg’s picture

Priority: Normal » Major
Issue summary: View changes

This is still happening with latest version of OG 7.x2.9. Followed the Procedure to upgrade in place from 6.x latest version of OG. HAd to use migrate 2.5 as the latest version gives lot of errors.

in OG 6.x there is a field (shows as chekbox in UI) Og_public which makes a content public in otherwise private group. Seems there is no equivalent field (by default) in og 7.x so the value of that field is not migrated at all making every content public.

I am wondering if this field is the cause. But what does not explain is for OG 6.x groups where everything is private should get migrated as private to OG7.x but after migration to OG 7.x all content is suddenly public even for anonymous users. The Actual group membership is getting migrated fine. But the node access permissions are not.

Making this as a major one since it is a major issue if private content is suddenly public.

ajayg’s picture

I was able to fix this as per the patch
https://www.drupal.org/node/2106575#comment-7963481

This patch solves one of the major issue with 6.x-7.x migration

You need to apply the patch before you enable migration and OG module, then enable OG module , run update.php, enable migration and migration UI module , run update.php and then goto admin/content/migrate and execute migrate.

Please note only combination of Migrate 7.x-2.5 and OG 7.x-2.9 + This patch is working now.