Permissions again :-(
I'm still having massively annoying permissions issues here in Boston. Conflicts between OG's "Organic Groups Access Control", CCK's "Content Permissions", and Workflow's "Workflow Access" permissions are rampant. (Posting to Boston too for compassion and insight.)
Depending on my settings, I get the "Content Permissions need to be rebuilt" message. Following that link and clicking the button results in a process that hangs at about 89%-99% -- it never completes. Or, to be difficult, sometimes it does complete but the error message (perms need to be rebuilt) comes back and the process then hangs.
Here's a small grid illustrating the problem (I tried all the different combos, just to be sure).
Modules:
CP = CCK Content Permissions
AC = Organic Groups Access Control
WA = Workflow Access
Msg = Error message shows up
Result = Rebuild Permissions pass / fail; hang %
CP AC WA --> Msg? Result
N N N --> N n/a
Y N N --> N n/a
N Y N --> Y Fail: 95%
N N Y --> Y Fail: 92%
Y Y N --> Y Fail: 91%
N Y Y --> Y Fail: 97%
Y N Y --> Y Fail: 91%
Y Y Y --> Y Fail: 97%
Per another suggestion, I added the following line to my sites/default/settings.php file:
ini_set('max_execution_time', 120);
in case PHP was timing out running a long script. There is very little content on the site.
I also tried editing a content type (per another posting that helped someone in a similar situation), but that did not solve the problem.
My questions:
-- What are the settings supposed to be for the standard baseline OMP config for each of these modules?
-- If these still end up conflicting, is there another solution? Do I need to uninstall a bunch of modults and reinstall? Am I hosed? Is there some other way to correct this situation?
Thanks,
-- Lane
Ical feed
this worked for me...
I would try boosting:
ini_set('max_execution_time', 120
even higher -
Also look at the php.ini memory level and make sure it is at least 16mb
Right now on one install I have the max_execution set at 300, because I was getting the WSOD.
Those 2 changes have saved me in several similar situations with a script timing out around 90%
I just set it to 0
I just set it to 0, which I believe is unlimited. It's stuck on 95% right now. :-(
And php.ini memory is set to 128M because we're using CiviCRM. :-)
Have you tried running the
Have you tried running the
node_access_rebuild()function manually? This can be done in several different ways, from using the Devel "Execute PHP" block to momentarily putting the function at the end of your page.tpl.php file.I have not tried this
I will look at this idea, although I'll need some more guidance to get started on it. I like the idea of having more debug code / error reporting, and maybe this can be used with that.
Let's spend some time on
Let's spend some time on this at the Drupal Cafe tonight.
Fixes
1 -
you have a bad node, or a node that creates an error on one of the node_access_records functions. Add some debugging code to each and see if you can track down what node.
I feel for you... I have a custom written access control that would never finish. Turned out I was doing a node_load on a node with an invalid user, which fails (no load happens), and the end result is that the loop was never finishing resetting to Zero for the rebuild counter.
2 -
you are aware that multiple access schemes tend to conflict, right? (Any Yes means Yes, so one module's No is ignored in favor of the yes from another Module) Module Grants is an interesting (but incomplete... patch coming soon) way to make them work together.
I was vaguely aware
I'll look into that idea. I was wishing there was more debug info available beyond a status bar when the rebuilding is happening. I'd like to see what it's actually doing.
I was aware to an extent, but not using the words you used. From what you've described, permissions-by-module are additive and least-restrictive. I was more aware that there were problems when multiple permissions / access modules were interacting (I'm very aware of that now.)
adding debug code
Drupal_set_message (aka dsm) is your friend. It won't show you while it's running, but it will show you AFTER the run, the next page you load.
Add some dsm('helpful info goes here, like $nid, or $node') into the various node_access_records functions, and see what they are doing.
There's also the multiple_node_access
There's also the multiple_node_access patch by agentrickard (included in Domain Access). It uses AND logic instead of OR logic when multiple node access modules are enabled.
I'm not familiar enough with it to know if it will work with Workflow Access, or for that matter if it even works when Domain Access isn't being used. Does anyone know?
Here's a link to the
Here's a link to the mentioned alter grants module (sorry, kept forgetting!)
http://i.intheclosets.com/node/9
As mentioned, you'll need to implement the alter hook and tweek the permissions to how you desire them. Also, I have not tested it on all the modules you are using so not sure if there's any issue (I know for one it will likely have issues with node access node grants, which I plan to test soon, but don't think you're using that. I've used it with user reference node access, workflow access, og access, and a custom access module).
Thanks to all!
I've tried a few of these so far, and with much guidance and help at the recent Drupal Cafe I think I'm good -- at the moment. I haven't stressed the system or done anything that will require rebuilding content permissions since then, so I can't be certain yet. Stay tuned -- I'll be working this week and next on parts of the site that rely on this.
Wish me luck!