Access Control
Several months ago, I was tasked with creating some way to assign roles to users in groups. I installed the og roles module. What I discovered was that this module simply assigned a role to a user, not to a user in a particular group. I realized what I needed was a way to assign a role to a user in a way so that the user would only have this role in this particular group, not sitewide and certainly not in all groups. To do this, I needed to understand Drupal permissions and Access Control worked. My progress on this particular task is here: http://drupal.org/node/87679
Fast forward a few months later, when I was trying to use OG and Taxonomy Access Control (TAC). To my horror, I discovered that if a node was posted to a group, a user who was not in the group could access the node if he had access to the Taxonomy term. And, vice versa, if a user was in a group that the node belonged to, but DID NOT have access to the Taxonomy term, he could still access the node. This, in my opinion, was two Access Control systems tolerating each other, not working together. My progress on ths particular task is noted here: http://drupal.org/node/122712
So, I set about, merrily hacking my way through, until I had resolved both issues. Unfortunately, hacking Drupal core code is not a very good long term solution. And, when I applied for a project for my og user roles module, Drupal Admin told me as much.
What I needed was an environment where I could discuss my ideas with like minded folk who wanted to achieve the same goal: Get Drupal Access Control to open up so that various ACS (access control systems) from various modules could work together instead of at cross purposes as they do now.
That's why I created this discussion group. My first task is to work on getting og user roles approved as a project. For that, I need to figure out how to get it working without hacking the user_access function in the user.module.
That's the plan.
Action items from Node Access BoF in Szeged
We had a terrific session and subsequent meeting at Drupalcon. We discussed a number of wishes for node access and here are the action items that resulted.
* Migrate all operations to hook_nodeapi('access') and deprecate hook_access(): KEN.
* Add a drupal_alter() after hook_node_access_records(): MOSHE
* Add a drupal_alter() after hook_node_grants(): UNASSIGNED. POSTPONED UNTIL DB_REWRITE_SQL IS GONE
* Administer nodes perm => 'bypass node access' KEN
* Node perms move to a new node_perms module which implements nodeapi('access') LARRY GARFIELD
Other items that need doing
Remove db_rewrite_sql() in favor of anode_accesstag on the queries. Modules alter the query as needed.pager query integration into db_select()
Bonus
- Mike Wacker gave us
flexible node access even for unpublished nodes
Idea: Menutree Permissions module - cascading menu-level access control by role/user ID - input needed :o)
Hello everyone,
I'm a complete newbie to writing Drupal apps and having not yet found anything which fits my needs properly, I'm setting out on writing a node access module which uses the site's primary navigation menu structure to define access permissions.
I'm still at a very early stage of planning, and the use case for the module is pretty specific, so I haven't even begun to consider all the "what-if"s associated with, say, what happens when the site admin decides to reassign the primary menu.
Drupal Coder Needed in Manhattan (New York) | Rent the Runway
VC-Backed startup looking for coders who can write and fix custom drupal modules
RenttheRunway.com has already been covered by fast company, The New York Times, and Instyle magazine and has official launch Monday, 11/9/2009 = an exciting time to be joining this rapidly growing company
Uber Cart and booking reservation system experience preferred
To start ASAP
full and part time applicants considered, compensation + equity
Please contact jf@renttherunway.com and abi.sach@gmail.com with your resume
Proposal for a module: TAC fields
I'm considering developing a module to extend the functionality of TAC to role/field combinations. TAC works wonderfully for controlling access to whole nodes based on their taxonomy, but it's all-or-nothing; the module currently has no way of leveraging the per-field access control offered by Content Permissions.
I don't think the functionality belongs in TAC itself, as my proposed module is an additional layer of complexity that's specific to CCK content types.
Making content type only for groups
I have site where we are introducing groups, problem where i am stuck right now is i want to create new content type which can only be added by members who belong to atlest one group. if they are not member of any group they cant add that content type. I cant make audience required as there are other content types in system which can be added on site without any audience.
Any ideas ? any solutions ? any work around ?
Abi
taxonomy_access_user module review
Hi drupal !
I'm posting here to request a review of a module i'd just coded and that i would
like to submit on drupal.org. Before doing this, i would like someone to review
my module. Even if i'm pretty confident with my code which i've been testing for last
2 weeks, i would prefer others' advice.
About the module :
This module provides taxonomy based user control for user but unlike modules already
available on drupal.org with inheritance notion. For more information please read the
README (available below).
Thank you by advance.
Code is available here on github : http://github.com/baloo/taxonomy-access-user
Or as a tgz : http://github.com/baloo/taxonomy-access-user/tarball/master
Multisite or Access Control Model?
I'm currently doing a proof of concept for Drupal as our Enterprise wide CMS. Our current site is http://www.cdha.nshealth.ca/. The current site is in a complete mess, and lacks and any decent functionality. We currently have 160+ sections on this site with approximately 200 contributors managing their own content.
Access Control for Administrative Tasks/Areas
Something I have had issues with on multiple sites I have worked on is administrative areas and permissions.
Example:
If I build a site for a client and then decide I want the client to be able to edit certain areas of the admin panel ("/admin/settings/site-information") but I don't want them to have full access to the administration area then there really isn't a good solution.
So, I ask... What exactly can be done about the issue? What would be some of the best work arounds?
Flexible access control
Some time ago I proposed a new access control system for Drupal, which would allow the creation of access rules based on various criteria, kind of like the filters in Views.
Comprehensive list of Content access modules and how to enable them to work together
I created a list of content permission modules that I have encountered with their weights on my system.
- Can we create a comprehensive list?
- How can they work together or should they. From your experience, what has been the worst and best combinations ?
- what effect does module weight have on implementation of access? is it true that if access is already granted, it will not be restricted by another module that comes into play later?
Weight/ Name/ Version/ Brief description
0 Content Permissions 6.x-2.x-dev Set field-level permissions for CCK fields.
(admin determines)
Multisites and shared databases
Hi,
I am planning a multisite project where I want to be able to share users and some content between sites.
All sites will be more or less clones of each other, but they will have different target markets (countries mainly).
What I want to do is:
<
ul>
Organic groups and ACL compatibility
Hi to all,
Our organisation recently decided to change our CMS from Joomla to Drupal. We would like to use groups on our site and organic groups seemed the obvious choice. I suggested this to our site designer but he immediately flag a concern with incompatibility of the Organic groups module with the ACL module as he found information in the OG handbook stating that "you can't use this module with other node access modules". He sent a query 2 weeks ago at http://drupal.org/node/384094 but has so far received no replies.
I also found a thread at http://drupal.org/project/og_user_roles which states that the OG user roles modules supports ACL. Does "support "mean that it is compatible? And does this mean that the OG module is as well?
Is the Organic groups module compatible with the ACL module? How can we use both OG and ACL modules together?
Domain Access BoF -- Drupalcon Thursday at 11:30
Domain Access and You
Building networked sites with Domain Access. Check the BoF board for details.
How to change my 5.x module to 6.x
Hi,
Currenty i upgrade my version 5.9 to 6.2. What r the changes in my own module for drupal 6.7. What is the difference between 6.2 to 6.5. If u know any document recommend to me.
thanks & regards,
Gnanasekar Boju
Question about content access module
I just downloaded the content access module and installed it, it was late and I was pretty sure that it was working, but this morning when I tried to check the module and start playing with it, and I can't find it any longer, the module is still there and enabled, I was pretty sure that I saw it in Administer > Content management > content type where there was a tab, but today I couldn't see it any longer, I've been through the whole menu and couldn't see it and couldn't find detailed documentation.
ACL or Rules-Based Security for Drupal?
Joomla has announced availability of new ACL: http://is.gd/iA5B and they seem pretty excited about it. Is that something for Drupal community to be jealous of?
If you come from a Java/J2EE background the clear answer is: NO (yes, in capital letters). You have to actually suffer from a structured, strict ACL to really appreciate the simplicity of a security system like that of Drupal.
Now, you may argue that Drupal security is slightly over-simplistic and too code-oriented (makes us, the developers happy) for "business" use.
LDAP Integration Help Module and Documentation Update. Looking for non Active Directory LDAP users
I've been working on an LDAP help module to help admins configuring ldap integration ( http://drupal.org/project/ldap_integration ).
I use Microsoft Active Directory for LDAP. I wanted to get some people who were using other ldaps together to:
1) test andgive me feedback so I can finish the help modules
2) work with me to update the documentation for ldap_integration: http://drupal.org/node/62217
Its functionality is based on what support requests from the ldap integration issue que:
- to make support and bug reports better by getting a more complete set of information
Node Access by Menu Position -- Does this exist, or should we build it (and can it be built)?
A client of ours -- a university -- has quite an extensive hierarchical menu structure. They want the ability to take a top-level menu item, such as "Current Students" and control which roles can manage (create/edit/delete, based on their role's permissions under admin/user/permissions) and view the content under that section. Permissions should cascade down to sub-items in the tree unless explicitly overridden. They also need to then restrict access to adding new pages underneath menu items they do not have access to.
Here's a mock-up that describes what we're after, since it's easier than me explaining. :) Also, I should point out that this is for Drupal 6.
Using OG for a e-learning & access control setup
Hello access control group,
I have been tapped with setting up an e-learing site with the following characteristics:
- Super administrator must manage (setup, delete) intructors.
- Instructors must administer (invite, accept, delete) all students to their class/group. Ideally, there is a way for the instructor to customize the registration/login page for their students.
- Once a student has access, they all have access to the same exact content (a set of lessons).
Question on OG user roles functionality
Hi, I sent this question to Drupal forums but dint get a response. I think this group is more apprpriate for it. Based on what I read here, seems like thr OG User roles is designed to do what I'm trying to accomplish, but couldn;t get it to behave as expected. I'm pretty new to this so just might need some clarifications on how to get this working.
Basically, I want to setup certain users with permissions to submit blogs only for specific groups (not system wide).
So here's what I did.
As admin:
