{"action":"created","issue":{"url":"https://api.github.com/repos/amitaibu/og/issues/214","repository_url":"https://api.github.com/repos/amitaibu/og","labels_url":"https://api.github.com/repos/amitaibu/og/issues/214/labels{/name}","comments_url":"https://api.github.com/repos/amitaibu/og/issues/214/comments","events_url":"https://api.github.com/repos/amitaibu/og/issues/214/events","html_url":"https://github.com/amitaibu/og/pull/214","id":157138777,"number":214,"title":"Fix permissions for non-administrators","user":{"login":"pfrenssen","id":442924,"avatar_url":"https://avatars.githubusercontent.com/u/442924?v=3","gravatar_id":"","url":"https://api.github.com/users/pfrenssen","html_url":"https://github.com/pfrenssen","followers_url":"https://api.github.com/users/pfrenssen/followers","following_url":"https://api.github.com/users/pfrenssen/following{/other_user}","gists_url":"https://api.github.com/users/pfrenssen/gists{/gist_id}","starred_url":"https://api.github.com/users/pfrenssen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pfrenssen/subscriptions","organizations_url":"https://api.github.com/users/pfrenssen/orgs","repos_url":"https://api.github.com/users/pfrenssen/repos","events_url":"https://api.github.com/users/pfrenssen/events{/privacy}","received_events_url":"https://api.github.com/users/pfrenssen/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/amitaibu/og/labels/ready%20for%20review","name":"ready for review","color":"009800"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-05-27T06:27:52Z","updated_at":"2016-05-27T09:43:18Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/amitaibu/og/pulls/214","html_url":"https://github.com/amitaibu/og/pull/214","diff_url":"https://github.com/amitaibu/og/pull/214.diff","patch_url":"https://github.com/amitaibu/og/pull/214.patch"},"body":"The logic in `og_entity_access()` is faulty. It is calling `OgAccess::userAccessEntity()` with the operation 'administer group', but this is invalid, the only allowed entity operations are 'view', 'create', 'update' and 'delete'.\r\n\r\nIt also seems that some of the other code in `og_entity_access()` are earlier attempts for working around this bug.\r\n\r\nThe solution seems pretty simple, if the user has the 'administer group' permission, then we simply return `AccessResult::neutral()`, which will grant access according to the user's normal privileges.\r\n\r\nLet's see what this breaks."},"comment":{"url":"https://api.github.com/repos/amitaibu/og/issues/comments/222105115","html_url":"https://github.com/amitaibu/og/pull/214#issuecomment-222105115","issue_url":"https://api.github.com/repos/amitaibu/og/issues/214","id":222105115,"user":{"login":"damiankloip","id":1053891,"avatar_url":"https://avatars.githubusercontent.com/u/1053891?v=3","gravatar_id":"","url":"https://api.github.com/users/damiankloip","html_url":"https://github.com/damiankloip","followers_url":"https://api.github.com/users/damiankloip/followers","following_url":"https://api.github.com/users/damiankloip/following{/other_user}","gists_url":"https://api.github.com/users/damiankloip/gists{/gist_id}","starred_url":"https://api.github.com/users/damiankloip/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/damiankloip/subscriptions","organizations_url":"https://api.github.com/users/damiankloip/orgs","repos_url":"https://api.github.com/users/damiankloip/repos","events_url":"https://api.github.com/users/damiankloip/events{/privacy}","received_events_url":"https://api.github.com/users/damiankloip/received_events","type":"User","site_admin":false},"created_at":"2016-05-27T09:43:18Z","updated_at":"2016-05-27T09:43:18Z","body":"I think when this was originally added we were actually checking a permission not an operation. So this changed at some point and the function didn't follow?"}}
{"actor":{"display_login":"damiankloip"}}