So I have a group content type called student portfolio, which is managed by the student. Then I have a group content node type called endorsement that can be written by professors that are group members.

Question 1: How do I prevent students from editing endorsements? There is no checkbox anywhere in my configuration that says the student role can edit endorsement. Also, on my group permissions, for Members, only "Edit own Endorsement content" is checked, but the student can still edit, which seems like a bug if you ask me.

I'm thinking I'll need some sort of hook_menu_local_tasks_alter() code, but just wanted to verify.

Question 2: How do I prevent the student from even viewing a group content page type? (This is a different project.) On the group page, I think this is just a simple matter of setting the permission on the pane, but I also don't want students to be able to view the stand-alone page.

2 Answers 2


Because group owners are considered the equivalent of "Super administrator" (user 1) of their group AND group content, which I happen to totally disagree with, this wound up being solved using hook_node_access() as follows for Question 1:

 * Implements hook_node_access().
 * Runs every time a user tries to edit an endorsement
function icme_admin_node_access($node, $op, $account) {
  if ($node->type == 'endoresment' && $op == 'update') {

    // Does the user explicitly have create/edit endorsement content access?
    // By default, the OG module provides group owners add/edit/delete access
    // to all group content
    $ua_create = user_access('create endoresment content');
    $ua_edit = user_access('edit own endoresment content');    
    if (!$ua_create && !$ua_edit) {
      // Show access denied message, and, interestingly enough, 
      // also sets the permission for the edit link.
      return NODE_ACCESS_DENY;

Question 2 is similar, but just need to change $op == 'update' to $op == 'view'.

I'm curious to see if anyone posts a better solution (other than fixing the OG module).


As @Webdrips said

'group owners are considered the equivalent of "Super administrator" (user 1) of their group AND group content'

However, this behavior may be controlled via an OG setting. Navigate to 'admin/config/group/settings' and UN-check option 'Group manager full permissions'.

On a side note, in my opinion this is a poor literal selection for the setting, as 'group manager' can be confused with the 'administrator member' role that manages the group. I've spent a few hours on a similar bug, and I had to dive into the code before I understood that this setting actually refers to the group author/creator.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.