Really I don't know if it's a bug or just OpenLucius works as designed but I noticed that if a Group was created with the Flag "Provide a menu link" then it shows up on the Toolbar of all existing users, also on Toolbar of users that don't belong to it/haven't been added to it (as expected OpenLucius correctly doesn't show that Group on the Groups drop down menu when viewed by those same users): this behaviour means that users which aren't members of a specific Group can still follow the (Group) link on their Toolbar and then reach the Group main page with its various actions buttons displayed.

Even if they can't then execute (unauthorized/access denied) anything dangerous within that Group (they can't view Group's members or they can't just add an event to the Group's Calendar) it would be nice to avoid to show them so easily a Group they don't actually belong. Right?

Comments

joris_lucius’s picture

joris_lucius
Primary language Dutch
commented
Category: Bug report » Feature request

I think you're working in OpenLucius as admin(uid1). The distro is not (yet) designed for that.
So for now, please only add content with users other than admin (uid1).

Keeping this open as a feature request.

-- Joris

dpoletto’s picture

dpoletto commented

Hi Joris, I'm working alternatively with two non admin users: User 1 (user/2) and User 2 (user/3) and, AFAIK, they aren't OL admin even if they both belong to the very first mandatory Group.

Clearly there is also the very first OL user which is the "admin" (user/1), I use it to create Groups even if I could create them using the permissions of non admin users (I created them with the Flag "can create groups" active).

Let me know which test I should do to verify if the behaviour is OK or not. Thanks again for the prompt support!

Kind regards, Davide.

joris_lucius’s picture

joris_lucius
Primary language Dutch
commented

Thanks for your info, it works as designed for now :-)
'Can create Groups' has 'Administer users'.

==> Keeping this open as a feature request, to only give 'admin' 'Administer users' perms.

dpoletto’s picture

dpoletto commented

Yes, I saw the Permissions scheme you linked and it's all clear now: only very specific users should have that Flag active (they are like the Admin user). Thanks. Davide.

joris_lucius’s picture

joris_lucius
Primary language Dutch
commented
Status: Active » Closed (outdated)

7.x is not supported anymore. OpenLucius 2.0 (Drupal 9) is now actively maintained.
So I'm closing this one.