KARL User Manual - Forbidden Error for Affiliates

[Jason Lantz]

Tom reported a problem with the Help link at the bottom of the page for affilaite users. I was able to recreate the problem with user "moroztom". After logging in, click the Help link at the bottom and you get a Forbidden error page. The About KARL community is visible by the user as well as the wiki in that community. However, clicking on the KARL User Manual link produces the Forbidden error page again. It appears there are specific acl's in that community that are out of whack. That community should be visible to all users of the system.

[Paul Everitt (paul-agendaless)]

Yep, that's a bug. Affiliates can get to the /communties/about-karl and the /communities/about-karl/wiki/front_page/ but not to any other wiki pages that are links from there. Smells like a bug we had previously, perhaps with Oxfam, during their migration.

The shocking (in a good way) thing is, ChrisM's workflow-security-geddon fixed this!! I just tried:

  http://kdi-dev.sixfeetup.com/communities/about-karl/wiki/frequently-asked-questions/

...as an affiliate, and it worked. Of course, we have many hours of testing to find out what else we might have broken.

Chris, I'll leave this as assigned to you, just to remind us to test it after we rollout mcdonc's changes. Or, if we have to bail on those changes, we'll go ahead and fix this bug.

[Chris Rossi (chris-archimedeanco)]

This appears to be fixed. See staging server.