Can't restrict permissions on forum topics?

Question

I have like a bit of an issue with my forum-topic content types : any authentificated user can edit and delete any post in the forums (node or comment of forum-topic type). It's not the case for any other content type where permissions works normal (user can edit/delete their own content, but not any content).

My features are the following:

User's permissions :

• Forum topic: Create new content -> auth user : YES ; admin : YES
• Forum topic: Edit own content -> auth user : YES ; admin : YES
• Forum topic: Edit any content -> auth user : NO ; admin : YES
• Forum topic: Delete own content -> auth user : NO ; admin : YES
• Forum topic: Delete any content -> auth user : NO ; admin : YES
• Bypass content access control -> auth user : YES ; admin : YES

The modules installed in the forums : Advanced forum, Forum Access.

Forum permissions (in admin/structure/forum/) view this forum - post in this forum - edit posts - delete posts : all checked for auth users and admin.

-> Disabling Forum access only make delete and edit any comment/reply on forum topic disappear. But any auth user can still delete or edit any topic.

-> Disabling "bypass content access control" make forum topic unvisible to auth users.

I hope it is somehow clear... And you can find what's going wrong.

Thanks !

Answer 1

The problem is that you selected "Bypass content access control" for the authenticated users. That means the previous permissions you chose for the authenticated users are not considered: You didn't give the permission of editing any forum topic, but as authenticated users are selected to bypass the content access control, Drupal will not check if they can edit any forum topic, and it will give them that permission.

If you look at the code of node_access(), the function that returns TRUE when a user has the access passed as argument for the node passed as second parameter, you will notice that it execute the following code:

if (user_access('bypass node access', $account)) {
  $rights[$account->uid][$cid][$op] = TRUE;
  return TRUE;
}

What you reported are only the Drupal core permissions, not the one set by the Forum access module. For the Drupal core permissions, you didn't report if the authenticated users have the "View published content" permission; without that, any published content would not be visible to any users, except the user #1, and the users with the "Administrator" role, for which Drupal automatically set all the permissions, but then leave you the possibility to disable some permissions.

The other problem is the conflict between Drupal core permissions, and the permissions set by the Forum Access module; when you use that module, you should not use the permissions used by Drupal core core, such as the ones you reported. If Forum Access needs to control the permissions, then the permissions you shown for the forum topics should not be set.

If the users get an "Access denied" error for every node, even if those are not forum topics and they have the permission to view published nodes, then the problem is something else. The first think I can think of is that those nodes are unpublished: There is an option in the content type settings that set its nodes as published, when created; if that option is not selecte, the nodes are created unpublished. It could also be a problem with an installed module (which is not Forum Access, as it doesn't handle permissions for other content types); in that case, I would not be able to give a hint about which module is causing the problem, but I see the same problem when the theme used as default theme was not enabled.

Answer 2

What do You think about Taxonomy Acces Control Lite? It seems to be the solution of Your problems.