In a recent Drupal implementation, we used the Organic Groups module to allow users in a certain role to add content to group nodes. On the content type edit screens, for "Organic groups usage", we chose "Standard group post (typically only author may edit)". Unfortunately, this text is a little deceiving. The OG module grants group administrators the ability to edit any node in the group, which was undesired for our situation.
In the og.module module file, the function og_menu_alter() overrides the normal access control of a user's ability to edit nodes:
<?php
function og_menu_alter(&$menu) {
// If og_access is disabled, we at least add back the edit tab for group admins to edit their posts.
$menu['node/%node/edit']['access callback'] = 'og_menu_access_node_edit';
$menu['node/%node/edit']['access arguments'] = array(1);
}
?>Prior to og_menu_alter() being executed, the menu structure was:
[access callback] => node_access
[access arguments] => Array
(
[0] => update
[1] => 1
)The above array structure relies on the node_access() function to determine if a user has permission to edit a node. One solution to this problem is to define code in a module to reset this menu structure:
<?php
function MYMODULE_menu_alter(&$menu) {
$menu['node/%node/edit']['access callback'] = 'node_access';
$menu['node/%node/edit']['access arguments'] = array('update',1);
}
?>Now, group administrators no longer have permission to edit every content item in a group.
