og_moderation module invokes clone_access_alter and causes permission issues for node_clone.

The clone page access argument function clone_access_cloning uses the $access boolean variable to determine access to cloning node.

It invokes an alter hook: drupal_alter("clone_access", $access, $node);

OG Moderation hooks into this and returns node access variables:
NODE_ACCESS_ALLOW ('allow')
NODE_ACCESS_DENY ('deny')
NODE_ACCESS_IGNORE (NULL)

These are not boolean values, in fact, NODE_ACCESS_IGNORE would return false for access when it should be allowing access.

The patch below detaches the $access boolean with the results of drupal_alter. However, now if a module doesn't use NODE_ACCESS_... variables it will not work properly. I'm not sure if this is a node_clone issue or og_moderation, what's the general practice for this?

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

pwolanin’s picture

Project: Node clone » Organic groups moderation
Version: 7.x-1.0-rc2 » 7.x-2.x-dev

This looks like a bug in og_moderation

jastraat’s picture

By setting $data to NODE_ACCESS_IGNORE by default, og_moderation is overwriting the $access value even it it isn't providing access. If another module is also implementing hook_clone_access_alter(), og_moderation completely overwrites any access grants by modules that fired before it.

Attached is a patch that only changes the access value if og_moderation is granting access.

jastraat’s picture

Updating credit.

jastraat’s picture

Status: Active » Needs review

Updating status.

jastraat’s picture

Also - you may want to update either the branch recommended in version control information or merge the changes from 7.x-2.x into master. Right now it's quite confusing.

Tunprog’s picture

I've found the same bug, patch #2 fixes the problem.

  • shenzhuxi committed 0a92e27 on 7.x-2.x authored by jastraat
    Issue #2368293 by jastraat, Siavash: hook_clone_access_alter...
shenzhuxi’s picture

Assigned: Siavash » shenzhuxi
Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.