OG 7.x-2.1
OG Access control NOT activated
Strict node access permissions NOT set
Domain Access 7.x-3.9

In several node views I use the "OG membership of node" and "Group node of OG membership" relationships.
"Requiere this relationship" is NOT set.
Output is "Teasers".

Non group content is not listed to normal users.
All roles which have the "Bypass content access control" permission do see non group content. As soon as I grant this permission to any role the non group content appears.
As soon as I remove both relationships non group content is shown to all users as expected.

Any idea?

Comments

creando sensaciones’s picture

creando sensaciones CreditAttribution: creando sensaciones commented

I was able to identity the cause in the query.
"OG membership of node" or "Group node of OG membership" are adding this condition to the query:

WHERE (( (na.gid = '0') AND (na.realm = 'all') )OR( (na.gid = '0') AND (na.realm = 'domain_site') )OR( (na.gid = '3') AND (na.realm = 'domain_id') ))AND (na.grant_view >= '1') AND (node_og_membership.nid = na.nid) ))

It requieres an entry in the node_og_membership table even if the relationship is optional.

creando sensaciones’s picture

creando sensaciones CreditAttribution: creando sensaciones commented

I solved the issue by checking the 'Query settings' > 'Disable SQL rewriting' checkbox.

Still I would appreciate feedback about the OG access control added to the query. Should it be like that, and will it be solved in future versions?

Dustin@PI’s picture

Dustin@PI CreditAttribution: Dustin@PI commented
Issue summary: View changes
Related issues: +#1349080: node_access filters out accessible nodes when node is left joined

Anyone stumbling on this problem ... this issue is probably the cause: #1349080: node_access filters out accessible nodes when node is left joined

golddragon007’s picture

golddragon007 CreditAttribution: golddragon007 commented

I have the same problem with og 2.7. I debugged a lot, than I find the 'real' solution, but I can't do it (I can't find the generator code, ect.).

You get a similar code like this from your second join (which is an another join):

 AND ( EXISTS  (SELECT na.nid AS nid
FROM 
node_access na
WHERE (( (na.gid = '0') AND (na.realm = 'all') )OR( (na.gid = '409') AND (na.realm = 'og_access:node') )OR( (na.gid = '411') AND (na.realm = 'og_access:node') )OR( (na.gid = '428') AND (na.realm = 'og_access:node') )OR( (na.gid = '431') AND (na.realm = 'og_access:node') )OR( (na.gid = '446') AND (na.realm = 'og_access:node') )OR( (na.gid = '451') AND (na.realm = 'og_access:node') ))AND (na.grant_view >= '1') AND (node_og_membership.nid = na.nid) ))

This code goes to the wrong place, it's need to be go to the end of the join and it will work correctly. Reason (which I find) the node_og_membership.nid is alway NULL in the main select ('outer' select) so it will always false the node_og_membership.nid = na.nid.

So, if you join a table with the main select, you need to put after the WHERE, if you join a table which was join, you need to put after THAT join's ON, which was the last join in the 'hierarchy'.

i.e.
Now (original):

SELECT [some select]
FROM 
node node
	LEFT JOIN og_membership og_membership_node ON node.nid = og_membership_node.gid AND og_membership_node.group_type = 'node'

	LEFT JOIN node node_og_membership ON og_membership_node.etid = node_og_membership.nid AND (og_membership_node.entity_type = 'node' AND node_og_membership.type = 'type_1')

	LEFT JOIN node node_og_membership_1 ON og_membership_node.etid = node_og_membership_1.nid AND (og_membership_node.entity_type = 'node' AND node_og_membership_1.type = 'type_2')

WHERE (( (node.status = '1') AND (node.type IN  ('content_type_name')) ))AND ( EXISTS  (SELECT na.nid AS nid
	FROM 
	node_access na
	WHERE (( (na.gid = '0') AND (na.realm = 'all') )OR( (na.gid = '409') AND (na.realm = 'og_access:node') )OR( (na.gid = '411') AND (na.realm = 'og_access:node') )OR( (na.gid = '428') AND (na.realm = 'og_access:node') )OR( (na.gid = '431') AND (na.realm = 'og_access:node') )OR( (na.gid = '446') AND (na.realm = 'og_access:node') )OR( (na.gid = '451') AND (na.realm = 'og_access:node') ))AND (na.grant_view >= '1') AND (node.nid = na.nid) ))<strong> AND ( EXISTS  (SELECT na.nid AS nid
	FROM 
	node_access na
	WHERE (( (na.gid = '0') AND (na.realm = 'all') )OR( (na.gid = '409') AND (na.realm = 'og_access:node') )OR( (na.gid = '411') AND (na.realm = 'og_access:node') )OR( (na.gid = '428') AND (na.realm = 'og_access:node') )OR( (na.gid = '431') AND (na.realm = 'og_access:node') )OR( (na.gid = '446') AND (na.realm = 'og_access:node') )OR( (na.gid = '451') AND (na.realm = 'og_access:node') ))AND (na.grant_view >= '1') AND (node_og_membership.nid = na.nid) )) AND ( EXISTS  (SELECT na.nid AS nid
	FROM 
	node_access na
	WHERE (( (na.gid = '0') AND (na.realm = 'all') )OR( (na.gid = '409') AND (na.realm = 'og_access:node') )OR( (na.gid = '411') AND (na.realm = 'og_access:node') )OR( (na.gid = '428') AND (na.realm = 'og_access:node') )OR( (na.gid = '431') AND (na.realm = 'og_access:node') )OR( (na.gid = '446') AND (na.realm = 'og_access:node') )OR( (na.gid = '451') AND (na.realm = 'og_access:node') ))AND (na.grant_view >= '1') AND (node_og_membership_1.nid = na.nid) ))</strong>
[some other stuff i.e. group by]

Need to be:

SELECT [some select]
FROM 
node node
	LEFT JOIN og_membership og_membership_node ON node.nid = og_membership_node.gid AND og_membership_node.group_type = 'node'

	LEFT JOIN node node_og_membership ON og_membership_node.etid = node_og_membership.nid AND (og_membership_node.entity_type = 'node' AND node_og_membership.type = 'type_1')<strong> AND ( EXISTS  (SELECT na.nid AS nid
		FROM 
		node_access na
		WHERE (( (na.gid = '0') AND (na.realm = 'all') )OR( (na.gid = '409') AND (na.realm = 'og_access:node') )OR( (na.gid = '411') AND (na.realm = 'og_access:node') )OR( (na.gid = '428') AND (na.realm = 'og_access:node') )OR( (na.gid = '431') AND (na.realm = 'og_access:node') )OR( (na.gid = '446') AND (na.realm = 'og_access:node') )OR( (na.gid = '451') AND (na.realm = 'og_access:node') ))AND (na.grant_view >= '1') AND (node_og_membership.nid = na.nid) ))</strong>

	LEFT JOIN node node_og_membership_1 ON og_membership_node.etid = node_og_membership_1.nid AND (og_membership_node.entity_type = 'node' AND node_og_membership_1.type = 'type_2')<strong> AND ( EXISTS  (SELECT na.nid AS nid
		FROM 
		node_access na
		WHERE (( (na.gid = '0') AND (na.realm = 'all') )OR( (na.gid = '409') AND (na.realm = 'og_access:node') )OR( (na.gid = '411') AND (na.realm = 'og_access:node') )OR( (na.gid = '428') AND (na.realm = 'og_access:node') )OR( (na.gid = '431') AND (na.realm = 'og_access:node') )OR( (na.gid = '446') AND (na.realm = 'og_access:node') )OR( (na.gid = '451') AND (na.realm = 'og_access:node') ))AND (na.grant_view >= '1') AND (node_og_membership_1.nid = na.nid) ))</strong>

WHERE (( (node.status = '1') AND (node.type IN  ('content_type_name')) ))AND ( EXISTS  (SELECT na.nid AS nid
	FROM 
	node_access na
	WHERE (( (na.gid = '0') AND (na.realm = 'all') )OR( (na.gid = '409') AND (na.realm = 'og_access:node') )OR( (na.gid = '411') AND (na.realm = 'og_access:node') )OR( (na.gid = '428') AND (na.realm = 'og_access:node') )OR( (na.gid = '431') AND (na.realm = 'og_access:node') )OR( (na.gid = '446') AND (na.realm = 'og_access:node') )OR( (na.gid = '451') AND (na.realm = 'og_access:node') ))AND (na.grant_view >= '1') AND (node.nid = na.nid) ))
	[some other stuff i.e. group by]
golddragon007’s picture

golddragon007 CreditAttribution: golddragon007 commented
Status: Active » Closed (duplicate)

I debugged a little more with xdebug and I agree with @Dustin@PI. This in not an OG bug, it's a views bug. In the https://www.drupal.org/node/1349080#comment-9449897 comment theres a patch which exactly worked and solved the problem, which I found too.