2

I have the Group module setup where I only allow view permission for group content to group members, so I have closed groups. But additionally, I want groups to also make some content public to non-members (but authenticated users) or to anonymous users even.

I have setup the Permissions by Term module for this where I made an "Additional view permissions" vocabulary that has two terms "all authenticated users" and "public". Those two terms I have granted permission to the respective roles. I had hoped that this would override the group permissions, but it doesn't. If I am not logged in, group content that has the "Additional view permissions" set to "public", still is not accessible to anonymous users.

I guess my question is: how does Drupal determine the priority of multiple modules arranging permissions for the same node, and can I influence this? In my case the group permissions seem to take priority, causing view permissions to be denied. But if it would first look at the permissions by term module, it would actually allow access.

Improve this question
2

Have a look at this feature request Allow other modules to alter gnode_node_access's forbidden result, especially this part of it:

If the group node's gnode_node_access module doesn't find a reason to return neutral, or to grant access, it returns a AccessResult::forbidden(). This prevents any other module from granting access. ...

So to "determine the priority of multiple modules arranging permissions for the same node" (as in your question): if the Group module denies access, then there is no way for any other module to overrule that access.

Maybe not what you like to hear/read, but this is how access is handled via Group module.

Improve this answer
5
  • Ok, thanks for the anwser. I am keeping an eye on that feature request and will see if I can contribute anything. Is there any other option that I am overlooking to fill my use-case?
    – Dolf Andringa
    Dec 10 '17 at 1:43
  • There is a patch in that link that provides a hook that allows other modules to modify the permissions from the group module. That patch, in combination with a patch I write for permissions by term, solve my problem. If the group module implements that patch, I will submit my patch to the permissions by term module.
    – Dolf Andringa
    Dec 10 '17 at 9:17
  • 1
    @DolfAndringa interesting! Also the extra comments you added in the issue I mentioned in my answer. Btw merci for the accept / +1 also.
    – Pierre.Vriens
    Dec 10 '17 at 9:27
  • Thanks @Pierre.Vriens. I added some more comments in the issue. I still have a problem there that I think are related to the priorities of permission modules. It seems the hook works fine in the permissions by term module adding on top of the gnode permissions, but the other way around, it looks like (but I'm not 100% sure and don't know how to debug) the permission by term module also restricts access now while the gnode access module actually allows access. So the problem reversed. Any idea? See the issue on d.o
    – Dolf Andringa
    Dec 12 '17 at 2:06
  • Nevermind. I fixed it (see issue thread).
    – Dolf Andringa
    Dec 12 '17 at 10:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.