Great module!

If hooks were inserted into the functions where the access control is determined, other modules could modify the access control. This will allow organic groups to offer all your modules permissions for the admins of each group.

Patch to follow...

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

johnennew’s picture

Status: Active » Needs review
FileSize
10.32 KB

Please find a patch which adds the hooks and implements them on behalf og organic groups. api.php file included.

Simon Georges’s picture

Bumping to see if test are launching.

johnennew’s picture

Rerolled #1 for latest dev updates.

johnennew’s picture

johnennew’s picture

Status: Needs review » Fixed

Tests passed - committing to 7.x-1.x

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

Nikit’s picture

Status: Closed (fixed) » Needs review
FileSize
4.1 KB

All content type was shown on OG Permissions page, this patch will fix that, only OG Content types will shown there.

Also on publish content admin page, there's checkbox is added. If checked and current content is group content type, then only OG Permissions will checked.
So user who are member of group, can publish or unpublish content (own/editable or all) in that group, even he hasn't access to publish or unpublish on global permissions.

Status: Needs review » Needs work
johnennew’s picture

I'd prefer to keep any og integration separate from the rest of the module so that it only modifies via the hooks. The tests are failing because the new code is interfering with the normal operation of the module. OG specific code should only reside within the functions publishcontent_og_permission, og_publishcontent_publish_access, og_publishcontent_unpublish_access

Is the publishcontent_og_permonly checkbox necessary? Permission model is such that you can only edit if you are granted permission either globally or within the group. I personally feel that if you want to deny the global permission within a group then that's specialist functionality within your own site and should not belong in this module. You can easily implement it for your site by using the developer integration hooks that were recently added.

Nikit’s picture

well, then you should out your og_publishcontent_publish_access and og_publishcontent_unpublish_access functions from your module, and create new one submodule, for example named as publishcontent_og.module.
Yes, I know that test will failed.

Yes, this checkbox should be on new publishcontent_og module.

Your publishcontent_publish_access function is too strict: it's deny access if one of modules deny it and break cycle: so I cann't control publish access via custom module, since it was terminated before accessing it - it's why I should patching, instead writing own permission on custom module.

So instead of foreach (module_invoke_all('publishcontent_publish_access', $node, $account), for example alteration will better (or just rewrite your code to be last module stronger):

    $publish_access = FALSE;
    drupal_alter('publishcontent_publish_access', $publish_access, $node, $account);

In this case last module will stronger than all, so custom module (with high weight) can decide, should it make access or not.

Also I made there some fixes, like removing non-groups content types in permissions list. And next comparing $account->uid == $account->uid on your code have been fixed to $account->uid == $node->uid.

johnennew’s picture

Hi @Nikit, thanks for your message and trying to improve the module, it is appreciated.

well, then you should out your og_publishcontent_publish_access and og_publishcontent_unpublish_access functions from your module, and create new one submodule, for example named as publishcontent_og.module.

I disagree - plenty of modules implement hooks on behalf of other modules - there is no need for a sub module to implement three hooks.

Your publishcontent_publish_access function is too strict: it's deny access if one of modules deny it and break cycle: so I cann't control publish access via custom module, since it was terminated before accessing it - it's why I should patching, instead writing own permission on custom module.

I see what you are saying about being too strict.

The permission control model here is very simplistic and should copy the model used by node_access. hook_publishcontent_publish_access implementations should either FALSE to flat deny access, TRUE to allow access or NULL say they don't care, in which case nothing will be allowed unless at least one other hook_publishcontent_publish_access said allow access. This is currently not happening.

So instead of foreach (module_invoke_all('publishcontent_publish_access', $node, $account), for example alteration will better (or just rewrite your code to be last module stronger):

Adding a alter hook here doesn't make the module stronger, it just changes the permission model to a last module wins model. I would rather do the node_access type model as described above properly.

Also I made there some fixes, like removing non-groups content types in permissions list. And next comparing $account->uid == $account->uid on your code have been fixed to $account->uid == $node->uid.

So you did - I have committed to latest development branch. Thanks!

johnennew’s picture

Status: Needs work » Needs review
FileSize
3.89 KB

@Nikit / testbot - what do you think of this patch...

johnennew’s picture

Status: Needs review » Fixed

I've checked this over and I am happy the patch in #12 represents the original intention of the module and addresses @Nikit's issue. Committing to 7.x-1.x branch.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.