In _subscriptions_og_node_options() and possibly elsewhere the code loads nodes from the database without using rewrite_sql(). That may allow groups to be displayed that the user should not be able to see.

Comments

develcuy’s picture

develcuy commented

I is not clear to me by now, but at this moment _subscriptions_og_node_options() loads nodes according to an array provided by og module which is on charge of check who must access what group. subscriptions_og_get_groups_by_types() and subscriptions_og_get_group_types() are called by subscriptions module to display subscription controls.

I'm not sure how to reproduce this if is a bug, please provide some guidelines.

Blessings!

gustav’s picture

gustav commented
Status: Active » Closed (duplicate)

Good point. This is an og bug, not a subscriptions_og bug, because the og module should not include the private groups in the $node->og_groups array. I have posed the issue in the og issue queue at http://drupal.org/node/231901 and marked this one as a duplicate.

gustav’s picture

gustav commented

And Moshe has already comitted a fix, see http://drupal.org/node/231901.