0

The scenario I try to achieve:

  1. Groups that are not public, are hidden for all users that are not member of the group.
  2. Users with the permission "Administer Organic groups permissions (Administer all groups and permissions)" should be able to view it regardless.

The OG setting for "strict node access" is enabled to prevent other users from viewing content that belongs to foreign private groups.

The problem lies with 2. Even though users with the "Admin OG permissions" permission can access /node/%/edit to modify the group entity, or even view the member list and add users to the group, viewing the group page itself is not possible nor is the group listed in the /groups view.

Is this a configuration issue or rather a bug?

1

After spending some time in the debugger, I would say this is a flaw in OG.

Users allowed to administer OG permissions should be granted access to view any group. Solution: patched og_node_access() in og.module:490

patch format:

--- og.module
+++ og.module
@@ -490,6 +490,11 @@ function og_og_default_roles() {
 function og_node_access($node, $op, $account) {
   $type = is_string($node) ? $node : (is_array($node) ? $node['type'] : $node->type);

+  //   Grant access to view any OG group content if the user is allowed to administer OG permissions
+  if ($op == 'view' && user_access('administer group', $account)) {
+    return NODE_ACCESS_ALLOW;
+  }
+
   if ($op == 'create' && og_is_group_content_type('node', $type)) {
     // Save some legwork if the user has the core permission and strict node
     // access is not set.

The interesting bit is just this:

  //   Grant access to view any OG group content if the user is allowed to administer OG permissions
  if ($op == 'view' && user_access('administer group', $account)) {
    return NODE_ACCESS_ALLOW;
  }


The above solved the issue with OG-Admins not being able to view private groups they did not belong to. There was another issue involving views. When for example creating a list of all groups with views, the same problem occurs. In this case, creating a separate view for admins and effectively disabling node access checks for it:

In the Advanced tab of Views UI under Query settings, select the Disable SQL rewriting checkbox

Various approaches detailed here: https://drupal.org/node/677644

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.