Access group_node overview is never used [#2774689]

Problem/Motivation

When using Group Node to attach nodes to a group, the group nodes overview is not secured so any visitor can see it.

Proposed resolution

Use the 'access group_node overview' group permission on the view.

Remaining tasks

Patch, Review, Commit

User interface changes

None.

API changes

None.

Data model changes

None.

Comment	File	Size	Author
#2	group-gnode-overviw-permission-2774689-2.patch	573 bytes	DuaelFr
#2	8.x-1.x: PHP 5.5 & MySQL 5.5, D8.2 Patch failed to apply PHP 5.6 & MySQL 5.5, D8.2 Patch failed to apply

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

28 July 2016 at 13:42

DuaelFr created an issue. See original summary.

Comment #2

DuaelFr

he/him

French

Montpellier, France

CreditAttribution: DuaelFr as a volunteer and at Happyculture commented 28 July 2016 at 13:43

Status:

Active

» Needs review

File	Size
group-gnode-overviw-permission-2774689-2.patch	573 bytes
8.x-1.x: PHP 5.5 & MySQL 5.5, D8.2 Patch failed to apply PHP 5.6 & MySQL 5.5, D8.2 Patch failed to apply

Comment #3

kristiaanvandeneynde

Dutch

Antwerp, Belgium

CreditAttribution: kristiaanvandeneynde at Deeson commented 1 August 2016 at 08:37

Yup, this actually causes the GroupOperations block to not show either! :)

I think we need a hook_update_N() to update the view for anyone who already has the module installed, though.

P.S.: Thanks for all the recent patches, much appreciated!

Comment #4

kristiaanvandeneynde

Dutch

Antwerp, Belgium

CreditAttribution: kristiaanvandeneynde at Deeson commented 2 September 2016 at 15:54

Status:

Needs review

» Fixed

I fixed this as part of commit 8577f388662b96c81417e3853cb6c25d3391850a without remembering we had an issue for it. I also added an update hook to that commit to update existing sites' group_nodes view.