My issue is similar to THIS REPORT except that i am using TAC instead of ACL ..

If a moderator or a member of a restricted forum area makes a post, it's subject is displayed in the Activity listing. if someone clicks it, they get the access-denied page, but the subject is exposed.

The built-in Tracker (site.com/tracker) does not have this issue; it obeys TAC and only displays what the viewer has access to.

Comments

jaydub’s picture

jaydub commented

The tracker only deals with nodes so it can rely on the built-in Drupal
node access system. The Activity module also contains entries for
other actions such as flagging, voting, buddy/friends requests and
such so there is no specific hook for access checking.

There will probably have to be something done to faciliate checks
for node access for nodeactivity and commentactivity modules
but for the time being, this is beyond the scope of Activity.

jaydub’s picture

jaydub commented

I think the approach in the patch here is going to get what we need: #254632: Move node access checks to load instead of display

jaydub’s picture

jaydub commented

Added an access check to the display phase of the activity records. Please test out on a development snapshot (10/31 or later).

jaydub’s picture

jaydub commented
Category: bug » task
MrGeek’s picture

MrGeek commented

When i installed it, the site broke immediately upon installation.. I dont have a test-site running so i did not have time to capture the exact error (i freaked out, sorry) ..

jaydub’s picture

jaydub commented
Status: Active » Postponed (maintainer needs more info)

well as stated this is a development snapshot so you really shouldn't be using on a production server yet! But you know that already as you've said. Without further information on what problem you ran into it's hard to know if there is in fact a problem with activity as there's been no other reports and no breakage here...If you get a chance to get a test site up and encounter the problem please post the details.

MrGeek’s picture

MrGeek commented

I know - i'm starting to sound like a 'user' .. "i got an error, but i dont know what it said" ..

Here is what I get - now i get it just by uploading the module and trying to view the modules page before i even activate it:

Parse error: syntax error, unexpected T_OBJECT_OPERATOR in /home/sitename/public_html/sites/all/modules/activity/activity.module on line 365

jaydub’s picture

jaydub commented

Ok I can't be sure which version you are using based on your report but I'm pretty sure you are talking about the code around this point:

if (db_fetch_object($result)->count != 0) {
return FALSE;
}

See this related issue (and other references to this issue within)
#323687: Parse error in PHP 4.x: unexpected T_OBJECT_OPERATOR

And from your error I am betting you are using Php4. At this point there's really no more reasons to stay on Php4. The Php team themselves have stopped development and support for Php4. Php 4.4.9 is the -last- release that will be made on the Php4 branch.

Let me know if in fact you are on Php4 and which version of the module you are testing with.

MrGeek’s picture

MrGeek commented

Using 5.4-Dev ... and PHP4 ... *bows head in shame*

MrGeek’s picture

MrGeek commented
Status: Postponed (maintainer needs more info) » Fixed

So far, running Dev from 11/5 on PHP5 it seems that TAC is being obeyed..
Still testing, but looks good so far.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.