I posted the following in the main Drupal.org forums, and someone suggested it might be better placed in this group:
I just saw the security advisory regarding OG Forum, and was distressed to see that there was no fix for it - the only advice was to disable the module.
There is one site I maintain where that module plays a really critical role - to just disable it, with no alternative, would cause huge problems. But obviously, I can't leave it up there if it's got major security holes that will never be fixed! So I really need to find a workable alternative.
What the site needs is basically a way of allowing each member to have a small, private forum, which is only accessible to that member plus a small handful of other people. It also needs to be fairly easy and intuitive to use. Can anyone recommend another way of accomplishing that apart from OG Forum?
Actually, looking at what happens when you click "create discussion" here, it looks like it's just using the story content type, rather than any kind of a forum as such. But it's also possible to see the stories without being a member, which for the site I'm using OG Forum on it can't be - the individual discussion areas have to be private, as people often need to discuss confidential subjects there.
I should add that I will also need to migrate all the content from the existing OG forums on the site into whatever solution is chosen, as there's important content in there that they're not going to want to lose.
Any advice would be much appreciated - thanks!
Comments
Take ownership of the project...
Not a great solution, and not attempting to be an ass, but have you thought about taking ownership of OGForums, talking to the Security team at Drupal and fixing the issue? The module just needs a new owner. You could also pay someone to fix it. I hate getting these answers but sometimes the issues are minor, but no one has the desire to fix them.
--Sig--
Owner of Proper Programming, LLC a software and website development firm.
I offered...
I offered to take ownership of the module, only to be sidestepped and then back to it being ignored...
At this point, I don't think people are interested enough in correcting the module and I'm looking for alternative methods of accomplishing the same functionality...
Is there a reason you do not see or do not want to see OG Forum's functionality added to OG?
fwiw, i would like to see OG
fwiw, i would like to see OG Forum working in some form, and it would make sense that the functionality is handled by OG out-of-the-box since forums are part of Drupal core, it would be great if OG worked with them.
Understanding Problem
I am following this issue but do not understand yet. If one marks a forum type as og post then the access control is made by og and not og forum alone, or? And it is listed on og_ghp_ron
If one is using OG as "default" forum type then it is NOT an og post (not listed on og home page og_ghp_ron) - why?
So why not just mark the forum content type as og type?
I am using path access and content access so nt possible for anoymous users to access form taxonomy or forum post
The OG Forum module allows
The OG Forum module allows each group to have their own forums along with their own moderators...
spaces_og for D6; just og for D7?
For Drupal 6, there is the Spaces module, which includes spaces_og. I've not tried it, but apparently it can configure per space (or group) nearly anything in Drupal (¿forums?), like if each group was a separate site. See the article Spaces 3: Customize Everything, for Anything, in Drupal.
For Drupal 7, since they say OG7 has new functionality, I'm not sure. However, something related about a site using OG7: