Incorrect Access Check on Media Library

Created on 31 July 2019, over 5 years ago
Updated 13 July 2024, 4 months ago

Hi,
I found a bug in Group module in regards to uploading Media.
The issue is that the Group access checks that override the default nodes aren't applying to Media. If a user has full Group permissions but no Node create permissions he can't upload media to the Node being created.
Assigning the global node permissions fixes the issue but then I have all authenticated users being able to create nodes, which defeats the purpose of using Group.
Can anyone help or point me in the right direction so I can write a patch?
Thanks!

🐛 Bug report
Status

RTBC

Version

3.2

Component

Code

Created by

🇦🇺Australia kyuubi

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • 🇦🇲Armenia sergey_gabrielyan Yerevan 🇦🇲

    I modified @bernardopaulino patch for the group 3 version

  • 🇨🇦Canada gwvoigt London, ON 🇨🇦

    Thanks Sergey Gabrielyan, I'm using your patch #33 and it fixed the issue here using Group 3.x

  • 🇺🇸United States potassiumchloride

    Can we get a new release of Group that includes the patch?

  • 🇺🇸United States kevin w

    Re-rolling the patch for 1.5.

  • 🇧🇪Belgium msnassar

    I have created a module "Group Media Library " that solves some issues when using media library with groups.

  • Please try this patch for incorrect access.

  • First commit to issue fork.
  • @rigoucr opened merge request.
  • Status changed to Needs review about 1 year ago
  • 🇨🇷Costa Rica rigoucr

    I Took patch #36 and replaced the old (deprecated) hook gnode_field_widget_media_library_widget_form_alter with gnode_field_widget_single_element_media_library_widget_form_alter and also now using this route , entity.group_content.create_form instead of entity.group_relationship.create_form.

    So, MR117 it's a reroll of #36

  • 🇬🇧United Kingdom lukus

    Hi @rigoucr .. I tried this out, but the route used in the conditional wasn't being called.

  • 🇦🇲Armenia le72 Yerevan 🇦🇲

    Have the same issue on Drupal 10.1.6 and Group 3.2.1
    Patches are not helping.
    Had the #33 patch in Drupal 9.4.x which was warking. After upgrading Drupal to 10 issue returns.

  • 🇦🇲Armenia le72 Yerevan 🇦🇲

    The patch #42 did the job. Thank you @lukus!

  • 🇫🇮Finland kekkis Pirkkala

    @le72, if the patch worked for you, why did you decided to delete it from the issue?

  • 🇦🇲Armenia le72 Yerevan 🇦🇲

    Not sure how it was happened :-( Can I delete others' files?

  • 🇦🇲Armenia le72 Yerevan 🇦🇲

    So, can't restore. The file from #42 works for me.

  • 🇺🇸United States jlashomb

    Patch #42 worked on 1.6 but didn't apply cleanly because the use statements are different. Here is a version of the patch that works with the 1.6 version of the module.

  • 🇺🇸United States jlashomb

    Comment #41 with patch MR117 is for the 1.x branch of groups and was what I needed. The patch from #42 seems to work on the 3.x branch, which I'll test soon on a different site.

    Disregard my last comment and ignore the patch I uploaded (group-media-library-access-for-1.6.patch). It was a broken mix of the two. I'm a bit rusty on Drupal patching and not sure why my initial tests looked like it worked.

  • Status changed to RTBC 10 months ago
  • 🇩🇪Germany fisherman90 Dortmund

    FYI for anyone reaching this issue after Upgrading to 10.2:

    The patch from #42 works great on Group 3.x and fixes the access in the media library Modal when creating a new Group-Node.

    I would mark it as RTBC for 3.x, but the Issue seems to be for multiple Group-Versions (with 1.x tagged) and I have not tested the 1.x patch.
    But since @jilashomb has confirmed, that 1.x seems to be working with the patch from #41, I will mark it as RTBC anyway.

    If this gives trouble, we could split the issue up for the different Group-Versions.

  • 🇺🇦Ukraine HitchShock Ukraine

    I can confirm that the patches work, but it's quite difficult to figure out when and which patch to use. Also, the patch #42 contains unnecessary changes.

    So I rerolled patches for each available version: 1.x, 2.x, 3.x

    The main difference between patches is the entity type name:
    - 1.x and 2.x - group_content
    - 3.x - group_relationship

  • 🇧🇪Belgium blacksnipe

    I came across the same issue when doing the same for commerce_products with an integration with Group Commerce .
    The access check is reverted to the default when trying to upload or select a Media entity. instead of checking the group permissions.

    The fix (for us) was to change gnode_node_create_access() to gnode_entity_create_access(), because the code of a possible gnode_commerce_product_create_access() would basically be the same as gnode_node_create_access() in the patches above.

    Beware: THE PATCHES ARE THE SAME AS THE ONES OF #52, with the difference they aren't exclusive to node entities.w

  • 🇺🇸United States jdearie

    Anyone have success getting this to work on the 4.x version? The 3.x versions don't appear to work.

Production build 0.71.5 2024