Hello,

After updating to 7.x.2.4 for the security update, a client ran in to a problem where users lost permission to edit their group's menu. I've tracked it down the the query below, which checks the if the group id is equal to the node id (which doesn't match). A patch is included containing a join with 'og' and condition if the entity id matches the node id.

http://cgit.drupalcode.org/og_menu/commit/?h=7.x-2.x&id=4487add08693493c...

I believe this should be the fix, so please review!

CommentFileSizeAuthor
incorrect_query_condition_in_og_menu_access.patch757 bytesjorisdejong

Comments

jaarong’s picture

jaarong commented

Same issue for me.

Pepper’s picture

Pepper commented

Thanks so much! I was just about to post this as an issue, but I didn't have the fix already like you did :) This should be committed... my users in testing couldn't list or edit their group menus, and that included user 1 (admin)!

  • rv0 committed 5e11dec on 7.x-2.x authored by jorisdejong 
    Issue #2400869 by jorisdejong: Incorrect query condition in...
rv0’s picture

rv0 commented
Status: Needs review » Fixed

Thanks for reporting, as I don't use the 2.x branch I had not noticed the issue myself.

7.x-2.5 with this fix is now pending release.

Pepper’s picture

Pepper commented

I may be having an issue with people without the Administer OG menus being able to edit OG menus for groups they're not a member of, now. Is it possible it's related to this fix? Unfortunately I had to patch a customized version of og_menu with the security patch, and tracking down what bug causes what is a little more difficult.

rv0’s picture

rv0 commented

I can only recommend not using a customized version, and even better, update to 3.x branch, which is much better in many aspects.

Pepper’s picture

Pepper commented

Hmm "Administer menus and menu items" is turned on for this role. Does that override any group restrictions?

We're looking to update to the 3.x branch, but the OG module was also modded, so we have to make sure all the changes that were made, are either in the newer versions or we can tweak them for our usage. Mostly mods were made to handle workflow / revision / translation issues.

rv0’s picture

rv0 commented

"Administer menus and menu items" indeed overrides group restrictions.

Never hack modules like that (for obvious reasons), you should use the API's to get the functionality you want.

Pepper’s picture

Pepper commented

Yeah, unfortunately it was another team that was hired to build this site that did it... we're "fixing" things :)
Thanks! I figured it was that permission, and why they set it I've no idea *facepalm*

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.