If I create an Organic Groups group node, MyGroup (nid=1234), and a content type, "Posts", that is set up for use as group content, what should the necessary permissions be to allow, for example, an anonymous user to create a Posts node in the MyGroup group?

I have seen writeups that imply all permutations of permission combinations, and also theoretically-fixed bug reports that imply things without any general rule in writing.

I know what appears to be current reality, as of 2.7 anyway, which is that I have to give the Drupal role "Anonymous" the permission "Posts: Create new content", and then also give the OG membership type "non-member" the permission "Create Posts content".

If I only specify the OG permission, the user gets an Access Denied error trying to load the /node/add/posts?og_group_ref=1234 form. If I only specify the Drupal role permission, the user has no problem loading that form and creating a node - but the node will not be in the MyGroup group. The only way to prevent the node creation is to make the group audience field (og_group_ref) required and hidden, so that if the prepopulated value from the URL isn't accepted, the field has no value, and so fails the required-field test.

Is this how it is supposed to work?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.