How to fix group access permissions?

Created on 3 September 2024, 4 months ago
Updated 18 September 2024, 3 months ago

Problem/Motivation

I have had groups access permissions issues multiple times. Now I would like to clean up the mess in my site. :)

1. How to delete groups that do not show up on the list of groups at /admin/group? I ran into a problem, reported at https://www.drupal.org/project/group/issues/3471867 πŸ› New group does not allow access to group creator Fixed , which caused creation of some groups that I don't have access to. Is there a way to delete those stray groups?

2. How to restore access to a group that contains many entities but which also does not show up in the list now?

Thanks!

πŸ’¬ Support request
Status

Active

Version

2.2

Component

Code

Created by

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

  • Issue created by @leeksoup
  • Is there any solution for this?

  • πŸ‡¬πŸ‡·Greece vensires

    Seems like you found the solution yourself as described in #3471867-3: New group does not allow access to group creator β†’ ?

  • @vensires - No, that was a solution to a related problem but not this one.

    These groups do not show anywhere on the admin pages, and if I try to access the group directly, I get an Access Denied error. Is there any way for me to delete them?

  • πŸ‡¬πŸ‡·Greece vensires

    Thank you for the clarification! Since you mentioned β€œdrush” though… why not use the β€œdrush edel” (ex. Entity delete) command with proper parameters in order to delete the groups you have identified?

  • I didn't know about that command, but will give it a try.

    What about the question (b)? That group I want to restore, not delete.

    Thanks.

  • πŸ‡¬πŸ‡·Greece vensires

    What troubles me is that there are no other users having the same issue. I also don't work with Group 2.x so I can't help you technically.

    I have some ideas though...
    a) if the issue has been provoked by πŸ› New group does not allow access to group creator Fixed ; could you create a new role, join it with a Drupal role automatically and make sure it gets all the permissions required? Would that solve the problem for you?
    b) You could try checking in-code which part of the _access() implementations (hook_group_access() or others) are missing; if you know what you are lacking, you could more easily fix it.
    c) Create a new group entity with the same info you want (group field values etc) and then update that database records so that each reference to the old group is replaced with a reference to the new group. If the 2.x structure is still with group relationship entities/tables etc. it should really be straightforward I think. Needs testing, needs focus work, yes, but may be straightforward!

  • Thank you for the suggestions.

    a) if the issue has been provoked by #3471867: New group does not allow access to group creator; could you create a new role, join it with a Drupal role automatically and make sure it gets all the permissions required? Would that solve the problem for you?

    It was a group I created before that particular problem, but the permissions got messed up after one of the updates. I don't really understand what you mean here though. Where would I be creating a new role? What would I be joining? How would a Drupal role join automatically?

    c) Create a new group entity with the same info you want (group field values etc) and then update that database records so that each reference to the old group is replaced with a reference to the new group.

    Wouldn't it be easier to update the DB record for the existing group to fix the role problem? I took a look at the `group*` tables but it was not at all clear to me what was going on. There are a dozen tables including 2 whose names begin with group_relationship.

    I do appreciate your help!

  • Looking at an old DB backup, I see that the group with the messed-up access was created back before the group_relationship and group_relationship_field_data tables existed. For the other tables with names like group* the old data was carried over without changes and of course new groups etc have been added since then.

    Also, other members of the group CAN see all the group nodes, but I can only see the group forum posts. I should be able to see everything and administer the group.

  • πŸ‡¬πŸ‡·Greece vensires

    Thank you for the extra information!

    I just installed the 2.x version in simplytest.me and checked. The important thing for you to check here is if in admin/group/types/manage/[GROUP_TYPE_ID]/roles you have the following screen:

    Since you are the administrator of the website, I expect your user to match one of the last two rows of the roles table above. If you find one of them missing, you should add it from the proper Add group role page:

  • @vensires - Thank you! That did it! Once I set an insider role to sync with the Administrator global role, I could access all the groups.

    When I go into the admin for the group I want to recover, I see that I am listed 4 times on the members page: twice with no role and twice with a role that allows access to everything. So Idk why I wasn't able to access group content until I made the role change you suggested in #11.

    Also every other group member appears twice on the page /group/1/members ... only in this one group though.

    Thank you so much for your help!

  • πŸ‡¬πŸ‡·Greece vensires

    Perfect :) Glad it worked :)

    PS: I was looking for you at Drupal slack yesterday in order to provide more immediate help but couldn't find you. Would be useful! Next time ;)

  • I don't have a Slack account. I appreciate the suggestion though. Yes, maybe next time. :)

  • Automatically closed - issue fixed for 2 weeks with no activity.

Production build 0.71.5 2024