During working with "Organic groups" (7.x-2.0) and "Organic Groups Workflow Access" modules I found bug with node access-control. Looks like "Organic Groups Workflow Access" don't care about what group is checked for access.
For example:
There 2 content types which are groups (lets call them "Type 1" and "Type 2").
And there are 2 nodes of each type (lets call them "Group 1" and "Group
There is workflow with state "Published". This state is configured so that only members can of "Group 1" and/or members of "Group 2" can view nodes with such state (i.e. checkboxes (from group "Group roles who can view posts in this state") "Group 1 – member" and "Group 2 - member" are cheked).
"Group 2" has group content node ("Group node 1"). And this "Group node 1" is setted as "private" and is with state "Published".
Some user is member only of "Group 1". And this user should have access to "Group node 1" because it is private and he/she isn't member of "Group 2", but this user can view it.
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | og_workflow_access-2070787-3.patch | 3.23 KB | fedia.io1 |
| #2 | og_workflow_access-2070787-2.patch | 3.06 KB | fedia.io1 |
Comments
Comment #1
fedia.io1 commentedI've corrected og_workflow_access_node_grants and og_workflow_access_node_access_records function to fix this issue.
Comment #2
fedia.io1 commentedHmm...
One more try to attach patch.
Comment #3
fedia.io1 commentedCorrected patch because previous patch #2 causes PDOException on saving og workflow access settings.
Comment #4
Tim-Erwin commentedfedia.io1,
thanks a lot for fixing this issue. I'll have a look at your patch soon and will integrate as appropriate.
Comment #5
Tim-Erwin commentedThis makes a whole lot of sense, committed (with a minor change: I find it more logical to assign roles as grand ids to group realms than the other way round).
Although one question remains:
In og_workflow_access_node_grants() you iterate over the entity types, but in og_workflow_access_node_access_records() you assume 'node' as type. Doesn't that cause any difficulties?
Comment #7
Tim-Erwin commented