og_forum: access checking fails, if menu_get_item() runs before og_init()

I'm actually getting the same problem here. Just trying OG Forums for the first time. My group is Closed. I have added a user to the group. User-1 can see the group and the post within the group forum. The normal user in the group can see the Group Forum in the main Forum List, but clicking on the Group Forum gives "Access Denied". However, if I paste the URL of the actual post within the group forum, it is displayed correctly. It's just the top level view of the Group Forum (the list of posts) that cannot be accessed.

I am running Advanced Forums 1.x and also Forum Access (again, for normal forums on the site). Disabling both of these modules did not help. I'll keep looking for other permission settings to try.

My group was set to "Closed Membership". When I changed the group to be "Invite Only" then it worked and the group forum was properly visible to group members. You might give that a try to see if it works for you.

Edited: Nevermind, that caused the posts within the Group Forum to be readable by anybody. Seems to be a conflict between the OG Forum access rules and the Forum Access module. If I restrict the Group Forum using the Forum Access settings, then I can prevent anonymous users from accessing the content of the group. But then it ignores group membership...authenticated users can view *any* group forum content.

Looks like the OG Forum module is only controlling whether a user can see the group, but the Forum Access module is still controlling the access to the forum posts themselves. Maybe I need to just completely remove Forum Access entirely. Although the last time I disabled the Forum Access module, I lost access to *all* forum posts. This whole thing is just getting really confusing. All I want is private forums assigned to Organic Groups and public forums using the normal forum module.

same problem here.

Marking as bug report, until someone proves me wrong..
Maybe this needs to be fixed in forum_access instead. In this case, we should rather create a new issue over there, to reduce confusion.

I found what is happening:

• Some module (menu_breadcrumb, in my case) implements hook_init(), and the implementation runs before og_init(). At this time, the global $user object does not yet contain the $user->og_groups information.
• menu_breadcrumb_init() calls menu_get_item(), and this indirectly calls the wildcard loader og_forum_group_type_load().
• og_forum_group_type_load() looks into the global $user->og_groups, and does not find any. Thus, it does not grant access, unless it has access from something else.

Probably this can be fixed with module weight (use the utility module).
I think og should make sure it runs first in hook_init. Or run in hook_boot instead.

module weight is insufficient.
We get a classical wolf-bites-its-tail problem here.

og_init does actually call menu_get_item() itself, indirectly, in more than one way, invoking the og_forum stuff that expects og_init to have finished already.

Here is the backtrace for my site. Others might have different modules causing the damage.

0: og_forum_group_type_load
1: _menu_load_objects
2: _menu_translate
3: menu_get_item
4: menu_get_object
5: i18n_selection_mode
6: i18ntaxonomy_db_rewrite_sql
7: call_user_func_array
8: module_invoke
9: _db_rewrite_sql
10: db_rewrite_sql
11: _node_types_build
12: node_get_types
13: og_get_types
14: og_get_sql_args
15: og_get_subscriptions
16: og_user
17: og_init
18: call_user_func_array
19: module_invoke_all
20: _drupal_bootstrap_full
21: _drupal_bootstrap
22: drupal_bootstrap

See also #553944: Define hook_menu_get_item_alter() as a reliable hook that runs before the page is doomed.

See also #285696: array_keys error.

user_load() helps.
Here is my fixed wildcard loader.

<?php
function og_forum_group_type_load($nid) {
  $node = node_load($nid);
  if ($node && og_is_group_type($node->type)) {
    // check if the current user can see the group forum.
    $tid = og_forum_get_forum_container($nid);
    if (og_forum_is_public($tid) || user_access('administer forums')) {
      return $tid;
    }
    // check if the current user is member of the group.
    $user = $GLOBALS['user'];
    if ($user->uid) {
      if (!is_array($user->og_groups)) {
        // og_init() has not finished yet,
        // so we have to take care of initialising the og_groups array.
        $user = user_load($user->uid);
      }
      if (!empty($user->og_groups) && array_key_exists($nid, $user->og_groups)) {
        return $tid;
      }
    }
  }
  return FALSE;
}
?>

I think this is not yet the solution that we should be happy with.
Imo, the access checking should be in an access callback, not in the wildcard loader. And imo, we should display something like "Please join this group so you can see all discussions", instead of "page not found".
This would still need this user_load() fix in the access callback.

Please forgive me if I don't post a patch. I hope the above code helps.
I post tons of bug reports with fixes in the d.o. issue queue, and taking the time to produce a patch for each is simply not realistic. If someone else wants to take the time, go ahead.
Thanks!